CVE-2026-72110

bpf,fork: wipe ->bpf_storage before bailouts that access it

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it

Currently, copy_process() can bail out to free_task() before p->bpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case):

copy_process dup_task_struct arch_dup_task_struct [copies the entire task_struct, including ->bpf_storage member] [RLIMIT_NPROC check fails] delayed_free_task free_task bpf_task_storage_free rcu_dereference(task->bpf_storage) bpf_local_storage_destroy

In this case, the nascent task's ->bpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF).

This is reachable as long as the process calling fork() has been inserted into a task storage map.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 7df67a4799067a59e6a2d53f8059a6be6e73e678Affected a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before aff686efd38728e06daf12417a0d7ed454ce4cffAffected a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74Affected a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 9cff220ddb65b022cc668bb652200742476e744cAffected a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before c4f626ddf2350652ad2f79daf1f10847f3f6eabdAffected a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 43f0005f81b8ce3be962d653cde8db9022f1e9b0Affected a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 9b51a6155d14389876916726430da30eabb1d4edAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 7df67a4799067a59e6a2d53f8059a6be6e73e678Affected
a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before aff686efd38728e06daf12417a0d7ed454ce4cffAffected
a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74Affected
a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 9cff220ddb65b022cc668bb652200742476e744cAffected
a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before c4f626ddf2350652ad2f79daf1f10847f3f6eabdAffected
a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 43f0005f81b8ce3be962d653cde8db9022f1e9b0Affected
a10787e6d58c24b51e91c19c6d16c5da89fcaa4b to before 9b51a6155d14389876916726430da30eabb1d4edAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.