GHSA-9WFF-G7FH-998R
Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-23 15:32In the Linux kernel, the following vulnerability has been resolved:
bpf,fork: wipe ->bpf_storage before bailouts that access it
Currently, copy_process() can bail out to free_task() before p->bpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case):
copy_process dup_task_struct arch_dup_task_struct [copies the entire task_struct, including ->bpf_storage member] [RLIMIT_NPROC check fails] delayed_free_task free_task bpf_task_storage_free rcu_dereference(task->bpf_storage) bpf_local_storage_destroy
In this case, the nascent task's ->bpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF).
This is reachable as long as the process calling fork() has been inserted into a task storage map.
{
"affected": [],
"aliases": [
"CVE-2026-72110"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T06:21:25Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf,fork: wipe -\u003ebpf_storage before bailouts that access it\n\nCurrently, copy_process() can bail out to free_task() before p-\u003ebpf_storage\nhas been initialized, with this call graph (shown here for the\n!CONFIG_MEMCG case):\n\ncopy_process\n dup_task_struct\n arch_dup_task_struct\n [copies the entire task_struct, including -\u003ebpf_storage member]\n [RLIMIT_NPROC check fails]\n delayed_free_task\n free_task\n bpf_task_storage_free\n rcu_dereference(task-\u003ebpf_storage)\n bpf_local_storage_destroy\n\nIn this case, the nascent task\u0027s -\u003ebpf_storage member that\nbpf_local_storage_destroy() operates on is a plain copy of the parent\u0027s\n-\u003ebpf_storage pointer, not a real initialized pointer.\nThis leads to badness (kernel hangs, UAF).\n\nThis is reachable as long as the process calling fork() has been inserted\ninto a task storage map.",
"id": "GHSA-9wff-g7fh-998r",
"modified": "2026-08-23T15:32:59Z",
"published": "2026-08-15T06:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72110"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/43f0005f81b8ce3be962d653cde8db9022f1e9b0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7df67a4799067a59e6a2d53f8059a6be6e73e678"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9b51a6155d14389876916726430da30eabb1d4ed"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9cff220ddb65b022cc668bb652200742476e744c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aff686efd38728e06daf12417a0d7ed454ce4cff"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c4f626ddf2350652ad2f79daf1f10847f3f6eabd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.