CVE-2026-72111

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is reached only through bpf(BPF_PROG_LOAD) during bpf_check()->check_mem_access() when a BPF_LSM_MAC program loads the LSM hook return value from PTR_TO_CTX; per kernel CNA guidance BPF verifier issues are Local even if attached programs later run on file, socket, or network LSM hooks.

AC:LAttack complexity, low

An attacker fully controls the BPF instruction sequence (e.g., BPF_MOV64_IMM to leave stale bounds, then a ctx retval load) and can deterministically force __mark_reg_s32_range() to intersect into an overly narrow range without races, special memory layout, or other uncontrollable conditions.

PR:LPrivileges required, low

Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON (is_perfmon_prog_type), both blocked for unprivileged users when kernel.unprivileged_bpf_disabled is set but obtainable inside user namespaces on typical CONFIG_BPF_LSM systems per kernel CNA BPF guidance.

UI:NUser interaction, none

No victim interaction is required; the attacker loads, verifies, and attaches their own malicious BPF LSM program and triggers the attached LSM hook with their own local syscalls or network operations.

S:CScope, changed

A container or user-namespace tenant with namespace-granted CAP_BPF can load a verifier-bypassing BPF LSM program whose runtime memory corruption executes in host kernel context on LSM hook firing, crossing the container-to-host security boundary on multi-tenant cloud and Android-style deployments.

C:HConfidentiality impact, high

The verifier/runtime register-bounds mismatch lets unsafe BPF programs pass verification and perform out-of-bounds reads on ctx, stack, or map memory at runtime, a memory-corruption primitive that can be developed into arbitrary kernel memory disclosure.

I:HIntegrity impact, high

False exact-knowledge of the LSM return-value register enables verifier-approved pointer arithmetic and memory writes that are invalid at runtime, enabling out-of-bounds writes and control-flow hijacking toward arbitrary kernel code execution from BPF context.

A:HAvailability impact, high

Running verifier-incorrect BPF LSM programs can trigger kernel oops or panic from corrupted memory accesses, and once attached the attacker can repeatedly invoke the hook to cause repeatable host-wide denial of service.