{"id":"CVE-2026-72427","title":"bpf: Fix effective prog array index with BPF_F_PREORDER","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix effective prog array index with BPF_F_PREORDER\n\nreplace_effective_prog() and purge_effective_progs() located the slot in\nthe effective array by walking the pro…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= bc8023ef3b11410682e5d4990e05e5bc2d3e1c94 < 525e408c27ae714e538b8c608c3a974df3ab6c92","Linux >= 555c0b713ca83968d3c843cb15485b9ba3367b1b < 41b4320b84fdafe1ab586b06453d30d50415db59","Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < 9697db03e010391c55ae75192cbdf30c5a72c114","Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < b584f107ab90222bd825dcb4c5977326ff684109","Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < f08aaee3152d0dfc578b3f2586932d82062701dd","Linux 4707ad649cf662add3058bff47430817811b048d","Linux >= 6.6.93 < 6.6.145","Linux >= 6.12.31 < 6.12.97","Linux >= 6.14.9 < 6.15","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:49:46.514218Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:23.555Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72427","references":[{"url":"https://git.kernel.org/stable/c/525e408c27ae714e538b8c608c3a974df3ab6c92"},{"url":"https://git.kernel.org/stable/c/41b4320b84fdafe1ab586b06453d30d50415db59"},{"url":"https://git.kernel.org/stable/c/9697db03e010391c55ae75192cbdf30c5a72c114"},{"url":"https://git.kernel.org/stable/c/b584f107ab90222bd825dcb4c5977326ff684109"},{"url":"https://git.kernel.org/stable/c/f08aaee3152d0dfc578b3f2586932d82062701dd"}],"tags":["cve.org"],"epss":0.0017,"epssPercentile":0.0595,"ingestedAt":"2026-10-16T19:46:24.396Z","slug":"CVE-2026-72427","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix effective prog array index with BPF_F_PREORDER\n\nreplace_effective_prog() and purge_effective_progs() located the slot in\nthe effective array by walking the program hlist and counting entries\nlinearly. That count does not match the array layout: compute_effective_\nprogs() places BPF_F_PREORDER programs at the front (ancestor cgroup\nfirst, attach order within a cgroup) and the rest after them (descendant\ncgroup first). So when a preorder program is present, the linear hlist\nposition no longer equals the program's index in the effective array.\n\nFor replace_effective_prog() (bpf_link_update()) this overwrote the\nwrong slot, corrupting the effective order. For purge_effective_progs(),\nit could dummy out a slot belonging to a different program and leave the\ndetached program in the array while bpf_prog_put() drops its reference,\ni.e. a use-after-free.\n\nFix both by replaying compute_effective_progs()'s placement (including\nthe per-cgroup preorder reversal) in a shared effective_prog_pos()\nhelper. Identify the entry by its struct bpf_prog_list pointer rather\nthan by (prog, link) value, so the lookup resolves to exactly the\nattachment the syscall selected even when the same bpf_prog is attached\nto several cgroups in the hierarchy.\n\n## Affected\n\n- `Linux >= bc8023ef3b11410682e5d4990e05e5bc2d3e1c94 < 525e408c27ae714e538b8c608c3a974df3ab6c92`\n- `Linux >= 555c0b713ca83968d3c843cb15485b9ba3367b1b < 41b4320b84fdafe1ab586b06453d30d50415db59`\n- `Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < 9697db03e010391c55ae75192cbdf30c5a72c114`\n- `Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < b584f107ab90222bd825dcb4c5977326ff684109`\n- `Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < f08aaee3152d0dfc578b3f2586932d82062701dd`\n- `Linux 4707ad649cf662add3058bff47430817811b048d`\n- `Linux >= 6.6.93 < 6.6.145`\n- `Linux >= 6.12.31 < 6.12.97`\n- `Linux >= 6.14.9 < 6.15`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}