CVE-2026-72111 (GCVE-0-2026-72111)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-10-16 18:44
VLAI
EPSS
VEX
Title
bpf: Reset register bounds before narrowing retval range in check_mem_access()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reset register bounds before narrowing retval range in check_mem_access()
When the BPF verifier processes a context load of an LSM hook return
value, it calls __mark_reg_s32_range() to narrow the register to the
hook's valid range. However, __mark_reg_s32_range() intersects the new
range with the register's existing bounds using max_t()/min_t() rather
than replacing them.
If the destination register carries stale bounds from a prior instruction
(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than
reality. The verifier then believes it knows the register's exact value,
while at runtime the actual hook return value is loaded, creating a
verifier/runtime mismatch that can be used to bypass BPF memory safety
checks.
The else branch already calls mark_reg_unknown() to reset register state
before any narrowing. Apply the same reset in the is_retval path so
stale bounds are cleared before __mark_reg_s32_range() intersects.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:41 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
5d99e198be279045e6ecefe220f5c52f8ce9bfd5 , < bde92f65042ec14389782dd223f706bf6b59ce5d
(git)
Affected: 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 , < 0993dc5fc619c0b25ab1310cb11d65e78351c0fe (git) Affected: 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 , < 5a55f9aecc08990940e70f0c7048a80850c5a16a (git) Affected: 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 , < 5e0b273e0a62cc04ec338c7b502797c66c2ed42a (git) Affected: 1050727d83e70449991c29dd1cf29fe936a63da3 (git) Affected: 27ca3e20fe80be85a92b10064dfeb56cb2564b1c (git) Affected: 6.10.13 , < 6.11 (semver) Affected: 6.11.2 , < 6.12 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.12
Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:41:38.213605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:44:56.296Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bde92f65042ec14389782dd223f706bf6b59ce5d",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"lessThan": "0993dc5fc619c0b25ab1310cb11d65e78351c0fe",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"lessThan": "5a55f9aecc08990940e70f0c7048a80850c5a16a",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"lessThan": "5e0b273e0a62cc04ec338c7b502797c66c2ed42a",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"status": "affected",
"version": "1050727d83e70449991c29dd1cf29fe936a63da3",
"versionType": "git"
},
{
"status": "affected",
"version": "27ca3e20fe80be85a92b10064dfeb56cb2564b1c",
"versionType": "git"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.13",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register bounds before narrowing retval range in check_mem_access()\n\nWhen the BPF verifier processes a context load of an LSM hook return\nvalue, it calls __mark_reg_s32_range() to narrow the register to the\nhook\u0027s valid range. However, __mark_reg_s32_range() intersects the new\nrange with the register\u0027s existing bounds using max_t()/min_t() rather\nthan replacing them.\n\nIf the destination register carries stale bounds from a prior instruction\n(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than\nreality. The verifier then believes it knows the register\u0027s exact value,\nwhile at runtime the actual hook return value is loaded, creating a\nverifier/runtime mismatch that can be used to bypass BPF memory safety\nchecks.\n\nThe else branch already calls mark_reg_unknown() to reset register state\nbefore any narrowing. Apply the same reset in the is_retval path so\nstale bounds are cleared before __mark_reg_s32_range() intersects."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through bpf(BPF_PROG_LOAD) during bpf_check()-\u003echeck_mem_access() when a BPF_LSM_MAC program loads the LSM hook return value from PTR_TO_CTX; per kernel CNA guidance BPF verifier issues are Local even if attached programs later run on file, socket, or network LSM hooks.\nAC:L - An attacker fully controls the BPF instruction sequence (e.g., BPF_MOV64_IMM to leave stale bounds, then a ctx retval load) and can deterministically force __mark_reg_s32_range() to intersect into an overly narrow range without races, special memory layout, or other uncontrollable conditions.\nPR:L - Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON (is_perfmon_prog_type), both blocked for unprivileged users when kernel.unprivileged_bpf_disabled is set but obtainable inside user namespaces on typical CONFIG_BPF_LSM systems per kernel CNA BPF guidance.\nUI:N - No victim interaction is required; the attacker loads, verifies, and attaches their own malicious BPF LSM program and triggers the attached LSM hook with their own local syscalls or network operations.\nS:C - A container or user-namespace tenant with namespace-granted CAP_BPF can load a verifier-bypassing BPF LSM program whose runtime memory corruption executes in host kernel context on LSM hook firing, crossing the container-to-host security boundary on multi-tenant cloud and Android-style deployments.\nC:H - The verifier/runtime register-bounds mismatch lets unsafe BPF programs pass verification and perform out-of-bounds reads on ctx, stack, or map memory at runtime, a memory-corruption primitive that can be developed into arbitrary kernel memory disclosure.\nI:H - False exact-knowledge of the LSM return-value register enables verifier-approved pointer arithmetic and memory writes that are invalid at runtime, enabling out-of-bounds writes and control-flow hijacking toward arbitrary kernel code execution from BPF context.\nA:H - Running verifier-incorrect BPF LSM programs can trigger kernel oops or panic from corrupted memory accesses, and once attached the attacker can repeatedly invoke the hook to cause repeatable host-wide denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:25.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bde92f65042ec14389782dd223f706bf6b59ce5d"
},
{
"url": "https://git.kernel.org/stable/c/0993dc5fc619c0b25ab1310cb11d65e78351c0fe"
},
{
"url": "https://git.kernel.org/stable/c/5a55f9aecc08990940e70f0c7048a80850c5a16a"
},
{
"url": "https://git.kernel.org/stable/c/5e0b273e0a62cc04ec338c7b502797c66c2ed42a"
}
],
"title": "bpf: Reset register bounds before narrowing retval range in check_mem_access()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72111",
"datePublished": "2026-08-15T05:52:52.538Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-10-16T18:44:56.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-72111",
"date": "2026-10-20",
"epss": "0.00176",
"percentile": "0.06757"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bde92f65042ec14389782dd223f706bf6b59ce5d",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"lessThan": "0993dc5fc619c0b25ab1310cb11d65e78351c0fe",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"lessThan": "5a55f9aecc08990940e70f0c7048a80850c5a16a",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"lessThan": "5e0b273e0a62cc04ec338c7b502797c66c2ed42a",
"status": "affected",
"version": "5d99e198be279045e6ecefe220f5c52f8ce9bfd5",
"versionType": "git"
},
{
"status": "affected",
"version": "1050727d83e70449991c29dd1cf29fe936a63da3",
"versionType": "git"
},
{
"status": "affected",
"version": "27ca3e20fe80be85a92b10064dfeb56cb2564b1c",
"versionType": "git"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.13",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register bounds before narrowing retval range in check_mem_access()\n\nWhen the BPF verifier processes a context load of an LSM hook return\nvalue, it calls __mark_reg_s32_range() to narrow the register to the\nhook\u0027s valid range. However, __mark_reg_s32_range() intersects the new\nrange with the register\u0027s existing bounds using max_t()/min_t() rather\nthan replacing them.\n\nIf the destination register carries stale bounds from a prior instruction\n(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than\nreality. The verifier then believes it knows the register\u0027s exact value,\nwhile at runtime the actual hook return value is loaded, creating a\nverifier/runtime mismatch that can be used to bypass BPF memory safety\nchecks.\n\nThe else branch already calls mark_reg_unknown() to reset register state\nbefore any narrowing. Apply the same reset in the is_retval path so\nstale bounds are cleared before __mark_reg_s32_range() intersects."
}
],
"id": "CVE-2026-72111",
"lastModified": "2026-10-16T19:17:08.553",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-72111",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:41:38.213605Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-15T06:21:25.447",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0993dc5fc619c0b25ab1310cb11d65e78351c0fe"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5a55f9aecc08990940e70f0c7048a80850c5a16a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5e0b273e0a62cc04ec338c7b502797c66c2ed42a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bde92f65042ec14389782dd223f706bf6b59ce5d"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-17T22:30:40+00:00",
"cve": "CVE-2026-72111",
"id": "CVE-2026-72111",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: bpf: Reset register bounds before narrowing retval range in check_mem_access()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72111.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.