Skip to main content

Linux Kernel EUVDEUVD-2026-59068

| CVE-2026-72110 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-9wff-g7fh-998r
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects the out-of-attacker-control precondition that the process must already be inserted into a BPF task storage map by an external eBPF program; all other metrics align with the official vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:53 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it

Currently, copy_process() can bail out to free_task() before p->bpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case):

copy_process dup_task_struct arch_dup_task_struct [copies the entire task_struct, including ->bpf_storage member] [RLIMIT_NPROC check fails] delayed_free_task free_task bpf_task_storage_free rcu_dereference(task->bpf_storage) bpf_local_storage_destroy

In this case, the nascent task's ->bpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF).

This is reachable as long as the process calling fork() has been inserted into a task storage map.

AnalysisAI

Use-after-free in the Linux kernel's BPF task storage subsystem allows a local low-privileged user to trigger a kernel hang or UAF condition during fork() failure. When copy_process() duplicates a task_struct via dup_task_struct, it copies the parent's bpf_storage pointer verbatim into the nascent child; if a subsequent RLIMIT_NPROC check causes the fork to abort, the cleanup path (bpf_task_storage_free → bpf_local_storage_destroy) operates on this uninitialized copied pointer rather than a valid child-owned one. No public exploit or CISA KEV listing exists at time of analysis, and EPSS is low at 0.21%, but kernel UAF conditions of this class are historically weaponizable into local privilege escalation.

Technical ContextAI

The vulnerability resides in the interaction between kernel/fork.c (copy_process) and the BPF local task storage subsystem (kernel/bpf/task_local_storage.c), introduced in Linux 5.13 when BPF task storage maps were added. dup_task_struct performs a shallow copy of the entire task_struct, including the bpf_storage pointer, before the child's BPF storage is properly initialized as a distinct object. In the !CONFIG_MEMCG code path, an RLIMIT_NPROC failure causes copy_process to jump to delayed_free_task → free_task → bpf_task_storage_free, which calls rcu_dereference(task->bpf_storage) and bpf_local_storage_destroy on what is effectively an aliased copy of the parent's live pointer - not a valid child allocation. This constitutes a CWE-672 (Operation on Resource After Expiration or Release) / CWE-416 (Use After Free) class defect, as the cleanup routine acts on a resource it does not own. The CWE field is not specified in NVD data; this classification is inferred from the description.

RemediationAI

The primary fix is to upgrade to a patched kernel: 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2 as appropriate for your distribution's stable series. Upstream fix commits are available at https://git.kernel.org/stable/c/43f0005f81b8ce3be962d653cde8db9022f1e9b0, https://git.kernel.org/stable/c/9b51a6155d14389876916726430da30eabb1d4ed, https://git.kernel.org/stable/c/9cff220ddb65b022cc668bb652200742476e744c, https://git.kernel.org/stable/c/c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74, and https://git.kernel.org/stable/c/c4f626ddf2350652ad2f79daf1f10847f3f6eabd. Where immediate patching is not feasible, set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged processes from interacting with BPF syscalls, which eliminates the ability for untrusted users to be inserted into task storage maps; note this may break eBPF-based tools (Cilium, Falco, bpftrace) that rely on unprivileged BPF access, requiring those agents to run with CAP_BPF. Restricting RLIMIT_NPROC independently is not a reliable mitigation, as the trigger condition depends on the limit being reached unexpectedly rather than a predictable threshold.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59068 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy