What is the CVSS score of CVE-2026-72426?

CVE-2026-72426 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72426?

A stack type confusion vulnerability in the Linux kernel BPF verifier (CVE-2026-72426, CVSS 8.4) permits local attackers to bypass security validation and gain full kernel memory read/write access,…. A patch is available.

How to fix or mitigate CVE-2026-72426?

Within 24 hours, inventory all Linux systems running kernel versions 7.1 stable prior to 7.1.5 or mainline prior to commit 3a354149bcea, particularly those accessible to untrusted local users. Within 7 days, deploy kernel updates to Linux 7.1.5 or later (or 7.2-rc1 for mainline systems) across all affected infrastructure. Within 30 days, validate all patched systems are running confirmed fixed kernel versions, review and restrict local user access privileges on critical systems, and implement kernel version compliance scanning to prevent regression.

Linux Kernel CVE-2026-72426

EUVD-2026-59325 HIGH

2026-08-15 Linux

GHSA-v693-v3px-mxpc

Information Disclosure Linux Red Hat Suse

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Loading BPF programs in practice requires at minimum low-privilege namespace access on most distributions, making PR:L more accurate than the NVD-assigned PR:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:21 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

HIGH 8.4

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer spill metadata during half-slot cleanup

__clean_func_state() cleans dead stack slots in 4-byte halves. When the high half of a STACK_SPILL slot is dead and the low half remains live, cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears the saved spilled_ptr metadata.

That conversion is safe only for scalar spills. For a pointer spill, this metadata clear lets a later 32-bit fill from the still-live half avoid the normal non-scalar register-fill check and be treated as an ordinary scalar stack read.

Leave non-scalar spill slots intact in this half-live shape. This is conservative for pruning and preserves the existing check_stack_read_fixed_off() rejection path for partial fills from pointer spills.

AnalysisAI

Stack type confusion in the Linux kernel BPF verifier allows a local attacker to bypass non-scalar pointer spill validation and treat a live kernel pointer slot as an ordinary scalar stack read. Affected are Linux 7.1 stable series prior to commit 0f9278b22cda and mainline prior to 3a354149bcea, with fixes confirmed in Linux 7.1.5 and 7.2-rc1. Successful exploitation permits full kernel memory read and write access, enabling local privilege escalation; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Linux kernel's eBPF verifier, specifically in the __clean_func_state() function, which cleans dead stack slots during BPF program analysis in 4-byte halves. BPF stack slots can hold typed values including STACK_SPILL (used when a register containing a pointer is saved to the stack), STACK_MISC, and STACK_ZERO. When the high half of a STACK_SPILL slot is determined dead while the low half remains live, the cleanup routine downgrades the live half to STACK_MISC or STACK_ZERO and erases the associated spilled_ptr metadata. This is safe for scalar spills but introduces a type confusion for pointer spills: with the metadata erased, a subsequent 32-bit fill from the still-live low half circumvents the check_stack_read_fixed_off() rejection path that would normally block partial fills from pointer spills, causing the verifier to treat a kernel pointer as an ordinary scalar value. No CWE identifier was formally assigned, but this maps conceptually to improper type-state management and verifier register-type confusion. Affected CPE: cpe:2.3:a:linux:linux:*.

RemediationAI

Upstream fix is available via stable kernel commits: upgrade Linux 7.1.x to 7.1.5 or later (commit 0f9278b22cda6fd2525049930157b79b4036b4ef), or upgrade to 7.2-rc1 or later (commit 3a354149bceacadbcf7d7b4766f5ef26a85892ab). For systems that cannot be patched immediately, a targeted compensating control is to disable unprivileged BPF loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl; this eliminates the no-privilege attack path but will break unprivileged observability tooling such as bpftrace and user-space BPF-based network monitoring in non-root contexts. Alternatively, disabling unprivileged user namespace creation (kernel.unprivileged_userns_clone=0 on supported distributions) removes the namespace-granted capability path, but breaks rootless container runtimes including Podman and rootless Docker. Both mitigations carry operational trade-offs; patching to 7.1.5 or 7.2-rc1 remains the definitive resolution. No distribution-level advisories (RHSA, DSA, USN) were present in the reference set at time of analysis.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72426 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72426

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code