CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it
In the Linux kernel, the following vulnerability has been resolved:
bpf,fork: wipe ->bpfstorage before bailouts that access it
Currently, copyprocess() can bail out to freetask() before p->bpfstorage has been initialized, with this call graph (shown here for the !CONFIGMEMCG case):
copyprocess duptaskstruct archduptaskstruct [copies the entire taskstruct, including ->bpfstorage member] [RLIMITNPROC check fails] delayedfreetask freetask bpftaskstoragefree rcudereference(task->bpfstorage) bpflocalstoragedestroy
In this case, the nascent task's ->bpfstorage member that bpflocalstoragedestroy() operates on is a plain copy of the parent's ->bpfstorage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF).
This is reachable as long as the process calling fork() has been inserted into a task storage map.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72110?
CVE-2026-72110 has a risk rating of 52, indicating a moderate level of severity.
How do I fix CVE-2026-72110?
To address CVE-2026-72110, ensure that you apply the latest patches provided by your Linux distribution.
Which versions of the Linux kernel are affected by CVE-2026-72110?
CVE-2026-72110 affects specific versions of the Linux kernel prior to the release of the fix related to this vulnerability.
What functionalities are impacted by CVE-2026-72110?
CVE-2026-72110 impacts the bpf_storage mechanism in the Linux kernel, particularly during process forking operations.
Is there a workaround for CVE-2026-72110?
Currently, no specific workarounds are documented for CVE-2026-72110, so applying the patch is recommended.