CVE-2026-72426
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup __clean_func_state() cleans dead stack slots in 4-byte halves. When the high half of a STACK_SPILL slot is dead and the low half remains live, cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears the saved spilled_ptr metadata. That conversion is safe only for scalar spills. For a pointer spill, this metadata clear lets a later 32-bit fill from the still-live half avoid the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. Leave non-scalar spill slots intact in this half-live shape. This is conservative for pruning and preserves the existing check_stack_read_fixed_off() rejection path for partial fills from pointer spills.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72426
EUVD
EUVD-2026-59325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of pointer spill metadata during stack cleanup. When a 64-bit pointer spill is partially cleaned, the metadata tracking it as a pointer is lost, allowing later operations to treat it as a scalar value. This bypasses safety checks for non-scalar stack reads.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or crashes, verifying kernel version against patched versions, and using BPF-specific tools like bpftool to inspect BPF programs and stack states.

Impact Analysis

This could allow an attacker with local access to exploit memory corruption in the kernel, potentially leading to privilege escalation, denial of service, or unauthorized data access. Systems running vulnerable Linux kernel versions are at risk.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the BPF stack spill metadata issue. If immediate patching is not possible, consider disabling BPF JIT compilation or restricting BPF program usage via kernel parameters until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart