CVE-2026-72428

Received Received - Intake

BPF Stack Slot Index Sanitization Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72428

EUVD

EUVD-2026-59327

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect stack slot indexing during Spectre v4 (Speculative Store Bypass) sanitization checks. The issue occurs when a fixed-offset stack write updates slot_type incorrectly, causing the pre-check to miss some bytes needing nospec sanitization. This could allow speculative execution attacks to bypass intended memory access restrictions.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel version and BPF-related configurations. Use commands like 'uname -a' to verify kernel version and 'lsmod | grep bpf' to check loaded BPF modules. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read sensitive data from memory they shouldn't access. This might include passwords, encryption keys, or other confidential information. The impact depends on system configuration and whether Spectre mitigations are enabled.

Compliance Impact

This vulnerability is a low-level kernel issue related to Spectre v4 mitigations and does not directly impact compliance with standards like GDPR or HIPAA. Compliance depends on broader system security practices rather than this specific bug.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the BPF stack slot index issue. Monitor vendor advisories for updates. If immediate patching is not possible, consider disabling BPF JIT compilation via sysctl or kernel boot parameters as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72428. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70