CVE-2026-72426
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel BPF mechanism, during cleanup of dead stack slots in 4-byte halves, when the high half of a STACK_SPILL slot is dead and the low half remains live, converting the low half to STACK_MISC or STACK_ZERO clears the spilled_ptr metadata. This is safe only for scalar spills, but for pointer spills it allows a later 32-bit fill from the live half to bypass the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. The fix leaves non-scalar spill slots intact in this half-live shape, which is conservative for pruning and preserves the existing rejection path for partial fills from pointer spills.
Risk Assessment
The vulnerability may allow unauthorized memory access in the kernel, potentially leading to privilege escalation or information disclosure.
Recommendation
Apply the official Linux kernel patch that addresses this issue as soon as possible, and monitor security advisories from your distribution.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup __clean_func_state() cleans dead stack slots in 4-byte halves. When the high half of a STACK_SPILL slot is dead and the low half remains live, cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears the saved spilled_ptr metadata. That conversion is safe only for scalar spills. For a pointer spill, this metadata clear lets a later 32-bit fill from the still-live half avoid the normal non-scalar register-fill check and be treated as an ordinary scalar stack read. Leave non-scalar spill slots intact in this half-live shape. This is conservative for pruning and preserves the existing check_stack_read_fixed_off() rejection path for partial fills from pointer spills.