CVE-2026-72428

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stack slot index in nospec checks

check_stack_write_fixed_off() computes the byte slot for a fixed-offset

stack write as -off - 1, and records each written byte in slot_type[] with

(slot - i) % BPF_REG_SIZE.

The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a

4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the

pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates

bytes 7..4. That can leave the second half-slot write without nospec_result

even though the bytes being overwritten still require sanitization.

Use the same slot index in the sanitization pre-check that the write path uses

when updating slot_type[].

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References