CVE-2026-72426

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where the clean func state() function incorrectly handles dead stack slots during 4-byte half-slot cleanup. When the high half of a STACK SPILL slot is dead but the low half remains live, the cleanup process converts the live low half to STACK MISC or STACK ZERO and clears the spilled ptr metadata. While this conversion is safe for scalar spills, for pointer spills, it allows a subsequent 32-bit fill from the live half to bypass the standard non-scalar register-fill check, causing it to be treated as an ordinary scalar stack read. This bypasses the rejection path normally handled by check stack read fixed off() for partial fills from pointer spills.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.