CVE-2026-72112: io_uring/bpf-ops: reject re-registration of an already-bound ops

In the Linux kernel, the following vulnerability has been resolved:

iouring/bpf-ops: reject re-registration of an already-bound ops

ioinstallbpf() only rejects a second registration on the ctx side (ctx->bpfops) and sets the per-map back-pointer ops->priv unconditionally. The structops link path never advances a map past BPFSTRUCTOPSSTATEREADY, so the same iouringbpfops map can be registered more than once, and bpfioreg() re-resolves the target ring via fget(ops->ringfd) on every call. A caller can therefore point the same ringfd at a different ioringctx between two BPFLINKCREATE calls.

The second registration passes the ctx->bpfops check (the new ctx has none) and overwrites ops->priv, orphaning the first ctx. Teardown (ioejectbpf()/bpfiounreg()) only reaches a ctx through ops->priv, so the orphaned ctx is never torn down: its ctx->loopstep keeps pointing into the structops trampoline, which is freed once the map is gone. A later iouringenter() on the orphaned ring then calls the dangling ctx->loopstep from iorunloop() -- a use-after-free of freed executable memory, reachable by a task with CAPBPF + CAPPERFMON.

Reject registration when ops->priv is already set, as hidbpfreg() does for its structops.