CVE-2026-72111 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, BPF users, and organizations relying on Linux kernel-based systems should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying patches, monitoring Linux kernel updates, and implementing compensating controls to restrict access to BPF functionality. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take steps to verify the effectiveness of mitigations. Affected operators and platforms should also be aware of the vulnerability and take steps to protect themselves. This vulnerability can have a significant impact on the security of Linux kernel-based systems, and it is essential to take prompt action to mitigate it. The vulnerability can be mitigated by applying patches, restricting access to BPF functionality, and implementing compensating controls. It is also essential to monitor Linux kernel updates for any additional patches related to BPF verifier vulnerabilities. Security teams should review the provided patches and apply them to ensure the BPF verifier is updated with the fix. Compensating controls, such as restricting access to BPF functionality, can also be implemented to mitigate potential risks. Asset inventory and rollback/change windows should also be reviewed to ensure that affected systems are properly protected. Source tracking and monitoring can also be used to detect and respond to potential attacks. Overall, a comprehensive approach is needed to mitigate this vulnerability and protect Linux kernel-based systems. This includes a combination of patching, compensating controls, and monitoring to ensure the security of affected systems. The vulnerability can be mitigated by taking a proactive and multi-faceted approach to security, including applying patches, implementing compensating controls, and monitoring Linux kernel updates. By taking these steps, organizations can reduce the risk of exploitation and protect their Linux kernel-based systems. The vulnerability is a significant risk to Linux kernel-based systems, and it is essential to take prompt action to mitigate it. The mitigation of this requires a

Technical summary

The Linux kernel's BPF verifier has a vulnerability that can lead to a verifier/runtime mismatch, allowing an attacker to bypass BPF memory safety checks. The issue arises when the verifier processes a context load of an LSM hook return value and fails to reset register bounds before narrowing the retval range in check_mem_access(). This can cause the verifier to believe it knows the register's exact value, while at runtime the actual hook return value is loaded, creating a verifier/runtime mismatch.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to ensure the BPF verifier is updated with the fix.
• Monitor Linux kernel updates for any additional patches related to BPF verifier vulnerabilities.
• Implement compensating controls, such as restricting access to BPF functionality, to mitigate potential risks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in the Linux kernel's BPF verifier. When processing a context load of an LSM hook return value, the verifier calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, if the destination register carries stale bounds from a prior instruction, the intersection can produce a range narrower than reality.

Official resources