CVE-2026-72111

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF verifier when processing a context load of an LSM hook return value. The verifier calls the mark reg s32 range() function to narrow the register to the hook's valid range, but it intersects the new range with existing bounds using max t() and min t() instead of replacing them. If the destination register contains stale bounds from a previous instruction, such as BPF MOV64 IMM, the resulting range may be narrower than the actual value. This creates a mismatch between the verifier's state and the actual runtime value, which can be exploited to bypass BPF memory safety checks. The issue occurs within the check mem access() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.