CVE-2026-72427

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix effective prog array index with BPF_F_PREORDER

replace_effective_prog() and purge_effective_progs() located the slot in

the effective array by walking the program hlist and counting entries

linearly. That count does not match the array layout: compute_effective_

progs() places BPF_F_PREORDER programs at the front (ancestor cgroup

first, attach order within a cgroup) and the rest after them (descendant

cgroup first). So when a preorder program is present, the linear hlist

position no longer equals the program's index in the effective array.

For replace_effective_prog() (bpf_link_update()) this overwrote the

wrong slot, corrupting the effective order. For purge_effective_progs(),

it could dummy out a slot belonging to a different program and leave the

detached program in the array while bpf_prog_put() drops its reference,

i.e. a use-after-free.

Fix both by replaying compute_effective_progs()'s placement (inc

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References