CVE-2026-72110
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, during fork(), the bpf_storage field in the task structure may not be initialized before certain error paths, leading to use of an uninitialized pointer. This can cause system hangs or use-after-free (UAF).
Risk Assessment
The vulnerability could be exploited by a local attacker to cause a denial of service or potentially escalate privileges if the UAF is successfully exploited.
Recommendation
Apply the kernel patch that wipes the bpf_storage field before error paths, and monitor systems for unusual behavior.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe ->bpf_storage before bailouts that access it Currently, copy_process() can bail out to free_task() before p->bpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case): copy_process dup_task_struct arch_dup_task_struct [copies the entire task_struct, including ->bpf_storage member] [RLIMIT_NPROC check fails] delayed_free_task free_task bpf_task_storage_free rcu_dereference(task->bpf_storage) bpf_local_storage_destroy In this case, the nascent task's ->bpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF). This is reachable as long as the process calling fork() has been inserted into a task storage map.