CVE-2026-72112

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free of freed executable memory exists in the Linux kernel. The io install bpf() function fails to properly reject the re-registration of an already-bound ops, as it unconditionally sets the per-map back-pointer ops->priv. This allows the same io uring bpf ops map to be registered multiple times, potentially pointing the same ring fd at different io ring ctx instances between BPF LINK CREATE calls. Consequently, a second registration can overwrite ops->priv, orphaning the first context. Because teardown functions like io eject bpf() and bpf io unreg() only access the context via ops->priv, the orphaned context is never torn down. Its ctx->loop step continues to point to the struct ops trampoline, which is freed when the map is removed. A subsequent call to io uring enter() on the orphaned ring then triggers the use-after-free via io run loop(). This issue is reachable by a task with CAP BPF and CAP PERFMON capabilities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.