CVE-2026-72112

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

io_uring/bpf-ops: reject re-registration of an already-bound ops

io_install_bpf() only rejects a second registration on the ctx side

(ctx->bpf_ops) and sets the per-map back-pointer ops->priv

unconditionally. The struct_ops link path never advances a map past

BPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be

registered more than once, and bpf_io_reg() re-resolves the target ring

via fget(ops->ring_fd) on every call. A caller can therefore point the

same ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE

calls.

The second registration passes the ctx->bpf_ops check (the new ctx has

none) and overwrites ops->priv, orphaning the first ctx. Teardown

(io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops->priv, so

the orphaned ctx is never torn down: its ctx->loop_step keeps pointing

into the struct_ops trampoline, which is freed once the map is gone. A

later io_uring_enter() on the o

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References