CVE-2026-72427
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix effective prog array index with BPF_F_PREORDER replace_effective_prog() and purge_effective_progs() located the slot in the effective array by walking the program hlist and counting entries linearly. That count does not match the array layout: compute_effective_ progs() places BPF_F_PREORDER programs at the front (ancestor cgroup first, attach order within a cgroup) and the rest after them (descendant cgroup first). So when a preorder program is present, the linear hlist position no longer equals the program's index in the effective array. For replace_effective_prog() (bpf_link_update()) this overwrote the wrong slot, corrupting the effective order. For purge_effective_progs(), it could dummy out a slot belonging to a different program and leave the detached program in the array while bpf_prog_put() drops its reference, i.e. a use-after-free. Fix both by replaying compute_effective_progs()'s placement (including the per-cgroup preorder reversal) in a shared effective_prog_pos() helper. Identify the entry by its struct bpf_prog_list pointer rather than by (prog, link) value, so the lookup resolves to exactly the attachment the syscall selected even when the same bpf_prog is attached to several cgroups in the hierarchy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72427
EUVD
EUVD-2026-59326

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of BPF program arrays when BPF_F_PREORDER is used. The issue occurs because the effective program array index is determined by linearly counting entries in a program list, which does not match the actual array layout. Programs with BPF_F_PREORDER are placed at the front of the array, while others follow. This mismatch causes functions like replace_effective_prog() and purge_effective_progs() to access the wrong array slots, leading to corruption of the effective order or even a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or crashes, particularly after BPF program updates or cgroup operations. Use commands like dmesg | grep -i bpf or journalctl -k | grep -i bpf to review kernel logs for anomalies.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code, escalate privileges, or cause a denial-of-service condition by triggering a use-after-free or corrupting kernel memory. Systems running vulnerable Linux kernels with BPF functionality enabled are at risk.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch the vulnerability. Avoid using BPF_F_PREORDER in BPF program attachments until patched. Monitor kernel logs for BPF-related crashes or errors as indicators of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart