CVE-2026-72111

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reset register bounds before narrowing retval range in check_mem_access()

When the BPF verifier processes a context load of an LSM hook return

value, it calls __mark_reg_s32_range() to narrow the register to the

hook's valid range. However, __mark_reg_s32_range() intersects the new

range with the register's existing bounds using max_t()/min_t() rather

than replacing them.

If the destination register carries stale bounds from a prior instruction

(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than

reality. The verifier then believes it knows the register's exact value,

while at runtime the actual hook return value is loaded, creating a

verifier/runtime mismatch that can be used to bypass BPF memory safety

checks.

The else branch already calls mark_reg_unknown() to reset register state

before any narrowing. Apply the same reset in the is_retval path so

stale bounds are cleared before __mark_r

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References