CVE-2026-72111
CVE CVE-2026-72111EUVD EUVD-2026-59069Published 2026-08-15T05:52:52.000ZLast changed 2026-08-17T05:40:25.000ZCVSS 8.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check_mem_access() When the BPF verifier processes a context load of an LSM hook return value, it calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than replacing them. If the destination register carries stale bounds from a prior instruction (e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than reality. The verifier then believes it knows the register's exact value, while at runtime the actual hook return value is loaded, creating a verifier/runtime mismatch that can be used to bypass BPF memory safety checks. The else branch already calls mark_reg_unknown() to reset register state before any narrowing. Apply the same reset in the is_retval path so stale bounds are cleared before __mark_reg_s32_range() intersects.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 6.11.2 <6.12; 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 <bde92f65042ec14389782dd223f706bf6b59ce5d; 6.10.13 <6.11; patch: 6.18.40; patch: 7.1.5; patch: 7.2; 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 <5a55f9aecc08990940e70f0c7048a80850c5a16a; patch: 0; 6.12; patch: 6.12.103; 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 <5e0b273e0a62cc04ec338c7b502797c66c2ed42a; 1050727d83e70449991c29dd1cf29fe936a63da3; 27ca3e20fe80be85a92b10064dfeb56cb2564b1c; 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 <0993dc5fc619c0b25ab1310cb11d65e78351c0fe
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.