CVE-2026-72110

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the copy process() function can bail out to free task() before the p->bpf storage member is properly initialized. During this process, the arch dup task struct() function copies the entire task struct, including the bpf storage member from the parent. If a failure occurs, such as an RLIMIT NPROC check failure, the system calls delayed free task(), which leads to free task() and subsequently bpf task storage free(). Because the bpf storage member is a copy of the parent's pointer rather than a newly initialized one, the bpf local storage destroy() function operates on an invalid pointer. This can result in Use-After-Free (UAF)—a condition where the system continues to use a memory address after it has been freed—and kernel hangs. This is reachable when a process calling fork() has been inserted into a task storage map.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.