CVE-2026-72111
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the BPF verifier fails to reset register bounds before narrowing the return value range of an LSM hook, leading to a verifier/runtime mismatch. An attacker could exploit this to bypass BPF memory safety checks.
Risk Assessment
The vulnerability may allow a local attacker to bypass BPF security mechanisms, potentially leading to privilege escalation or system integrity compromise.
Recommendation
Apply the kernel patch that resets register bounds before narrowing the range, and restrict access to BPF programs for unprivileged users.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check_mem_access() When the BPF verifier processes a context load of an LSM hook return value, it calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than replacing them. If the destination register carries stale bounds from a prior instruction (e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than reality. The verifier then believes it knows the register's exact value, while at runtime the actual hook return value is loaded, creating a verifier/runtime mismatch that can be used to bypass BPF memory safety checks. The else branch already calls mark_reg_unknown() to reset register state before any narrowing. Apply the same reset in the is_retval path so stale bounds are cleared before __mark_reg_s32_range() intersects.