CVE-2026-72427

Status: UPDATED  |  Advisory ID: CVE-2026-72427

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix effective prog array index with BPF_F_PREORDER

replace_effective_prog() and purge_effective_progs() located the slot in

the effective array by walking the program hlist and counting entries

linearly. That count does not match the array layout: compute_effective_

progs() places BPF_F_PREORDER programs at the front (ancestor cgroup

first, attach order within a cgroup) and the rest after them (descendant

cgroup first). So when a preorder program is present, the linear hlist

position no longer equals the program's index in the effective array.

For replace_effective_prog() (bpf_link_update()) this overwrote the

wrong slot, corrupting the effective order. For purge_effective_progs(),

it could dummy out a slot belonging to a different program and leave the

detached program in the array while bpf_prog_put() drops its reference,

i.e. a use-after-free.

Fix both by replaying compute_effective_progs()'s placement (including

the per-cgroup preorder reversal) in a shared effective_prog_pos()

helper. Identify the entry by its struct bpf_prog_list pointer rather

than by (prog, link) value, so the lookup resolves to exactly the

attachment the syscall selected even when the same bpf_prog is attached

to several cgroups in the hierarchy. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References