CVE-2026-72423

Received Received - Intake

BPF Conntrack Opts Error Write Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal lookup or allocation helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. Keep returning NULL for invalid arguments, but only report the error through opts->error when the supplied size includes the field. This preserves error reporting for the supported 12-byte and 16-byte layouts, and for other invalid sizes that still include opts->error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72423

EUVD

EUVD-2026-59322

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper bounds checking in BPF (Berkeley Packet Filter) conntrack functions. The issue occurs when the kernel writes error status to a memory location without verifying if the provided size includes that location. This can lead to out-of-bounds memory writes if an attacker provides an invalid size smaller than the expected structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if the kernel version is vulnerable. Use uname -a to check kernel version and dmesg | grep -i bpf to search for BPF-related errors.

Impact Analysis

This vulnerability could allow an attacker with local access to potentially escalate privileges, execute arbitrary code, or cause a denial-of-service condition by triggering out-of-bounds memory writes in the kernel. It primarily affects systems using BPF features with conntrack functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue related to memory safety in BPF (Berkeley Packet Filter) operations, specifically involving conntrack options handling. There is no evidence it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability.

Hi! I’m here to help you understand CVE-2026-72423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70