CVE-2026-72112 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of systems relying on io_uring and BPF operations should be aware of this vulnerability and take steps to mitigate it. Affected Linux kernel developers should verify the presence of this fix in their distributions and test it thoroughly. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize patching or mitigation efforts accordingly.

Technical summary

The io_uring subsystem in the Linux kernel did not properly handle re-registration of BPF operations structs. When re-registering an already-bound ops, the code did not reject the operation, leading to a use-after-free vulnerability. An attacker with CAP_BPF and CAP_PERFMON can exploit this to potentially escalate privileges. The vulnerability arises from the fact that io_install_bpf() only rejects a second registration on the ctx side and sets the per-map back-pointer ops->priv unconditionally. The struct_ops link path never advances a map past BPF_STRUCT_OPS_STATE_READY, allowing the same io_uring_bpf_ops map to be registered more than once.

Defensive priority

High

Recommended defensive actions

• Inventory and verify Linux kernel versions to identify potentially affected systems.
• Apply vendor patches or updates to address the vulnerability.
• Implement compensating controls, such as restricting access to CAP_BPF and CAP_PERFMON.
• Monitor system logs for suspicious activity related to io_uring and BPF operations.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by rejecting re-registration of an already-bound ops. Evidence is limited; further verification is needed to confirm affected scope and vendor remediation. Linux kernel developers should verify the presence of this fix in their distributions and test it thoroughly. Additional testing and validation are required to ensure that the fix is effective and does not introduce any new vulnerabilities. The io_uring and BPF operations should be closely monitored for any suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.