CVE-2026-72352

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The flaw is only reachable through local bpf() syscalls that load BPF_PROG_TYPE_STRUCT_OPS HID-BPF programs and attach them via BPF_LINK_CREATE; per kernel CNA guidance BPF subsystem bugs are Local even though callbacks may later run on HID input.

AC:LAttack complexity, low

Once a HID-BPF program is loaded, the attacker fully controls offset and rdwr_buf_size passed to hid_bpf_get_data(); values such as offset=2 with size=~0 reliably wrap the unsigned sum and bypass the check without races or uncontrollable memory layout.

PR:LPrivileges required, low

Loading BPF_MAP_TYPE_STRUCT_OPS maps and BPF_PROG_TYPE_STRUCT_OPS programs requires CAP_BPF (sysctl_unprivileged_bpf_disabled blocks unprivileged BPF); per kernel CNA guidance this is Low because CAP_BPF can be delegated via BPF tokens into user namespaces, not only init-namespace root.

UI:NUser interaction, none

The attacker loads and attaches their own HID-BPF program and triggers hid_bpf_get_data() from its callbacks; no separate victim action such as mounting, opening a file, or plugging in a device is required beyond the attacker's own bpf operations.

S:UScope, unchanged

Exploitation corrupts kernel heap memory from within the same kernel security authority to achieve local privilege escalation; it does not inherently cross VM, IOMMU, or container sandbox boundaries as a distinct scope change.

C:HConfidentiality impact, high

The overflow lets BPF code obtain a pointer outside the allocated HID-BPF context buffer and read adjacent kernel heap memory, enabling arbitrary kernel information disclosure and supporting further exploitation primitives.

I:HIntegrity impact, high

The same out-of-bounds pointer allows arbitrary kernel heap writes through the returned buffer, enabling control of adjacent objects and potential arbitrary code execution in kernel context.

A:HAvailability impact, high

Large out-of-bounds reads/writes against kmalloc-backed HID-BPF buffers can corrupt critical kernel structures and cause kernel oops, panic, or hang during HID-BPF callback execution.