{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72110", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.906Z", "datePublished": "2026-08-15T05:52:51.805Z", "dateUpdated": "2026-08-17T05:40:23.770Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:40:23.770Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf,fork: wipe ->bpf_storage before bailouts that access it\n\nCurrently, copy_process() can bail out to free_task() before p->bpf_storage\nhas been initialized, with this call graph (shown here for the\n!CONFIG_MEMCG case):\n\ncopy_process\n dup_task_struct\n arch_dup_task_struct\n [copies the entire task_struct, including ->bpf_storage member]\n [RLIMIT_NPROC check fails]\n delayed_free_task\n free_task\n bpf_task_storage_free\n rcu_dereference(task->bpf_storage)\n bpf_local_storage_destroy\n\nIn this case, the nascent task's ->bpf_storage member that\nbpf_local_storage_destroy() operates on is a plain copy of the parent's\n->bpf_storage pointer, not a real initialized pointer.\nThis leads to badness (kernel hangs, UAF).\n\nThis is reachable as long as the process calling fork() has been inserted\ninto a task storage map."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via fork()/clone()/clone3() into copy_process() and free_task()->bpf_task_storage_free(); per kernel guidance BPF/fork paths are Local and no network-facing handler can drive this early-bailout teardown.\nAC:L - The attacker controls all conditions: dup_task_struct copies parent ->bpf_storage, then they can deterministically force early copy_process failure (setrlimit(RLIMIT_NPROC) plus fork, fork-until-EAGAIN, or nr_threads exhaustion) to hit bpf_local_storage_destroy on the copied pointer.\nPR:L - Exploitation needs only a local process already inserted into a BPF task storage map (sched_ext/tracing BPF on servers, or BPF loaded via user-namespace CAP_BPF/unprivileged BPF); fork itself needs no real-root capability, so PR:L per user-namespace guidance.\nUI:N - No victim action is required; the attacker triggers the failed fork on a process they run and control the bailout timing themselves.\nS:U - Impact is in-kernel UAF/heap corruption and denial of service on the parent task's BPF local storage; this is standard kernel memory corruption without VM, container, or IOMMU boundary crossing.\nC:H - Destroying the parent's live bpf_local_storage via the child's stale ->bpf_storage pointer is a use-after-free; freed bpf_local_storage/bpf_local_storage_elem objects can be reclaimed for arbitrary kernel memory disclosure per UAF guidance.\nI:H - bpf_local_storage_destroy() unlinks and frees parent storage still referenced by the live forking task, enabling heap grooming and attacker-controlled writes over freed BPF local storage structures for privilege escalation.\nA:H - The fix commit reports kernel hangs and UAF; tearing down active BPF task local storage during failed fork can oops, panic, or deadlock the system, satisfying High availability impact for kernel crashes/UAF."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "lessThan": "c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74", "status": "affected", "versionType": "git"}, {"version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "lessThan": "9cff220ddb65b022cc668bb652200742476e744c", "status": "affected", "versionType": "git"}, {"version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "lessThan": "c4f626ddf2350652ad2f79daf1f10847f3f6eabd", "status": "affected", "versionType": "git"}, {"version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "lessThan": "43f0005f81b8ce3be962d653cde8db9022f1e9b0", "status": "affected", "versionType": "git"}, {"version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "lessThan": "9b51a6155d14389876916726430da30eabb1d4ed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74"}, {"url": "https://git.kernel.org/stable/c/9cff220ddb65b022cc668bb652200742476e744c"}, {"url": "https://git.kernel.org/stable/c/c4f626ddf2350652ad2f79daf1f10847f3f6eabd"}, {"url": "https://git.kernel.org/stable/c/43f0005f81b8ce3be962d653cde8db9022f1e9b0"}, {"url": "https://git.kernel.org/stable/c/9b51a6155d14389876916726430da30eabb1d4ed"}], "title": "bpf,fork: wipe ->bpf_storage before bailouts that access it", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74", "status": "affected", "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "versionType": "git"}, {"lessThan": "9cff220ddb65b022cc668bb652200742476e744c", "status": "affected", "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "versionType": "git"}, {"lessThan": "c4f626ddf2350652ad2f79daf1f10847f3f6eabd", "status": "affected", "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "versionType": "git"}, {"lessThan": "43f0005f81b8ce3be962d653cde8db9022f1e9b0", "status": "affected", "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "versionType": "git"}, {"lessThan": "9b51a6155d14389876916726430da30eabb1d4ed", "status": "affected", "version": "a10787e6d58c24b51e91c19c6d16c5da89fcaa4b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf,fork: wipe ->bpf_storage before bailouts that access it\n\nCurrently, copy_process() can bail out to free_task() before p->bpf_storage\nhas been initialized, with this call graph (shown here for the\n!CONFIG_MEMCG case):\n\ncopy_process\n dup_task_struct\n arch_dup_task_struct\n [copies the entire task_struct, including ->bpf_storage member]\n [RLIMIT_NPROC check fails]\n delayed_free_task\n free_task\n bpf_task_storage_free\n rcu_dereference(task->bpf_storage)\n bpf_local_storage_destroy\n\nIn this case, the nascent task's ->bpf_storage member that\nbpf_local_storage_destroy() operates on is a plain copy of the parent's\n->bpf_storage pointer, not a real initialized pointer.\nThis leads to badness (kernel hangs, UAF).\n\nThis is reachable as long as the process calling fork() has been inserted\ninto a task storage map."}], "id": "CVE-2026-72110", "lastModified": "2026-08-17T06:18:10.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:25.320", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/43f0005f81b8ce3be962d653cde8db9022f1e9b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b51a6155d14389876916726430da30eabb1d4ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9cff220ddb65b022cc668bb652200742476e744c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4f626ddf2350652ad2f79daf1f10847f3f6eabd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf,fork: wipe ->bpf_storage before bailouts that access it", "id": "2516548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516548"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's BPF/fork component. A local user, by initiating a `fork()` operation from a process within a task storage map, can trigger a condition where the `bpf_storage` is not properly initialized. This can lead to a Use-After-Free (UAF) vulnerability, which occurs when the system attempts to use memory after it has been freed. Exploitation of this flaw could result in kernel hangs or other system instability, effectively causing a denial of service."], "name": "CVE-2026-72110", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72110\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72110\nhttps://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72110-a5a7@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a10787e6d58c24b51e91c19c6d16c5da89fcaa4b,c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a10787e6d58c24b51e91c19c6d16c5da89fcaa4b,9cff220ddb65b022cc668bb652200742476e744c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a10787e6d58c24b51e91c19c6d16c5da89fcaa4b,c4f626ddf2350652ad2f79daf1f10847f3f6eabd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a10787e6d58c24b51e91c19c6d16c5da89fcaa4b,43f0005f81b8ce3be962d653cde8db9022f1e9b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a10787e6d58c24b51e91c19c6d16c5da89fcaa4b,9b51a6155d14389876916726430da30eabb1d4ed)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T09:00:06.793280+00:00", "updated": "2026-08-18T04:45:04.402607+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}