---
id: CVE-2026-72110
title: 'bpf,fork: wipe ->bpf_storage before bailouts that access it'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf,fork: wipe ->bpf_storage before bailouts that access it

  Currently, copy_process() can bail out to free_task() before p->bpf_storage
  has been initialized, with this…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    7df67a4799067a59e6a2d53f8059a6be6e73e678
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    aff686efd38728e06daf12417a0d7ed454ce4cff
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    9cff220ddb65b022cc668bb652200742476e744c
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    c4f626ddf2350652ad2f79daf1f10847f3f6eabd
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    43f0005f81b8ce3be962d653cde8db9022f1e9b0
  - >-
    Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b <
    9b51a6155d14389876916726430da30eabb1d4ed
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:41:35.831908Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:44:56.143Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72110'
references:
  - url: 'https://git.kernel.org/stable/c/7df67a4799067a59e6a2d53f8059a6be6e73e678'
  - url: 'https://git.kernel.org/stable/c/aff686efd38728e06daf12417a0d7ed454ce4cff'
  - url: 'https://git.kernel.org/stable/c/c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74'
  - url: 'https://git.kernel.org/stable/c/9cff220ddb65b022cc668bb652200742476e744c'
  - url: 'https://git.kernel.org/stable/c/c4f626ddf2350652ad2f79daf1f10847f3f6eabd'
  - url: 'https://git.kernel.org/stable/c/43f0005f81b8ce3be962d653cde8db9022f1e9b0'
  - url: 'https://git.kernel.org/stable/c/9b51a6155d14389876916726430da30eabb1d4ed'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.05786
ingestedAt: '2026-10-16T19:46:24.433Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it

Currently, copy_process() can bail out to free_task() before p->bpf_storage
has been initialized, with this call graph (shown here for the
!CONFIG_MEMCG case):

copy_process
  dup_task_struct
    arch_dup_task_struct
      [copies the entire task_struct, including ->bpf_storage member]
  [RLIMIT_NPROC check fails]
  delayed_free_task
    free_task
      bpf_task_storage_free
        rcu_dereference(task->bpf_storage)
        bpf_local_storage_destroy

In this case, the nascent task's ->bpf_storage member that
bpf_local_storage_destroy() operates on is a plain copy of the parent's
->bpf_storage pointer, not a real initialized pointer.
This leads to badness (kernel hangs, UAF).

This is reachable as long as the process calling fork() has been inserted
into a task storage map.

## Affected

- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < 7df67a4799067a59e6a2d53f8059a6be6e73e678`
- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < aff686efd38728e06daf12417a0d7ed454ce4cff`
- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < c3fd6f28c7ce1142a3b23dbb840eaa4777de1d74`
- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < 9cff220ddb65b022cc668bb652200742476e744c`
- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < c4f626ddf2350652ad2f79daf1f10847f3f6eabd`
- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < 43f0005f81b8ce3be962d653cde8db9022f1e9b0`
- `Linux >= a10787e6d58c24b51e91c19c6d16c5da89fcaa4b < 9b51a6155d14389876916726430da30eabb1d4ed`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.