Look up another CVE · open CVE-2026-72110 in the interactive tracker
CVE-2026-72110
bpf,fork: wipe ->bpf_storage before bailouts that access it
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem kernel. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72110 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Currently, copy_process() can bail out to free_task() before p->bpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case): copy_process dup_task_struct arch_dup_task_struct [copies the entire task_struct, including ->bpf_storage member] [RLIMIT_NPROC check fails] delayed_free_task free_task bpf_task_storage_free rcu_dereference(task->bpf_storage) bpf_local_storage_destroy In this case, the nascent task's ->bpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF). This is reachable as long as the process calling fork() has been inserted into a task storage map.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/fork.c
- What this is
- EXEC & BINFMT API, ELFMAINTAINERS section matched on kernel/fork.c · linux-mm@kvack.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.13 | 5.15.217 | 7df67a479906 |
| 5.13 | 6.1.184 | aff686efd387 |
| 5.13 | 6.6.145 | c3fd6f28c7ce |
| 5.13 | 6.12.97 | 9cff220ddb65 |
| 5.13 | 6.18.40 | c4f626ddf235 |
| 5.13 | 7.1.5 | 43f0005f81b8 |
| 5.13 | 7.2 | 9b51a6155d14 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached via fork()/clone()/clone3() into copy_process() and free_task()->bpf_task_storage_free(); per kernel guidance BPF/fork paths are Local and no network-facing handler can drive this early-bailout teardown.
- AC:LAttack complexity, low
- The attacker controls all conditions: dup_task_struct copies parent ->bpf_storage, then they can deterministically force early copy_process failure (setrlimit(RLIMIT_NPROC) plus fork, fork-until-EAGAIN, or nr_threads exhaustion) to hit bpf_local_storage_destroy on the copied pointer.
- PR:LPrivileges required, low
- Exploitation needs only a local process already inserted into a BPF task storage map (sched_ext/tracing BPF on servers, or BPF loaded via user-namespace CAP_BPF/unprivileged BPF); fork itself needs no real-root capability, so PR:L per user-namespace guidance.
- UI:NUser interaction, none
- No victim action is required; the attacker triggers the failed fork on a process they run and control the bailout timing themselves.
- S:UScope, unchanged
- Impact is in-kernel UAF/heap corruption and denial of service on the parent task's BPF local storage; this is standard kernel memory corruption without VM, container, or IOMMU boundary crossing.
- C:HConfidentiality impact, high
- Destroying the parent's live bpf_local_storage via the child's stale ->bpf_storage pointer is a use-after-free; freed bpf_local_storage/bpf_local_storage_elem objects can be reclaimed for arbitrary kernel memory disclosure per UAF guidance.
- I:HIntegrity impact, high
- bpf_local_storage_destroy() unlinks and frees parent storage still referenced by the live forking task, enabling heap grooming and attacker-controlled writes over freed BPF local storage structures for privilege escalation.
- A:HAvailability impact, high
- The fix commit reports kernel hangs and UAF; tearing down active BPF task local storage during failed fork can oops, panic, or deadlock the system, satisfying High availability impact for kernel crashes/UAF.