CVE-2026-72110

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-72110

Key Details

CVE	CVE-2026-72110
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it

Currently, copy_process() can bail out to free_task() before p->bpf_storage

has been initialized, with this call graph (shown here for the

!CONFIG_MEMCG case):

copy_process

dup_task_struct

arch_dup_task_struct

[copies the entire task_struct, including ->bpf_storage member]

[RLIMIT_NPROC check fails]

delayed_free_task

free_task

bpf_task_storage_free

rcu_dereference(task->bpf_storage)

bpf_local_storage_destroy

In this case, the nascent task's ->bpf_storage member that

bpf_local_storage_destroy() operates on is a plain copy of the parent's

->bpf_storage pointer, not a real initialized pointer.

This leads to badness (kernel hangs, UAF).

This is reachable as long as the process calling fork() has been inserted

into a task storage map. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72110
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72110

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-72110

CVE

https://www.cve.org/CVERecord?id=CVE-2026-72110