---
id: CVE-2026-72427
title: 'bpf: Fix effective prog array index with BPF_F_PREORDER'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix effective prog array index with BPF_F_PREORDER

  replace_effective_prog() and purge_effective_progs() located the slot in
  the effective array by walking the pro…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bc8023ef3b11410682e5d4990e05e5bc2d3e1c94 <
    525e408c27ae714e538b8c608c3a974df3ab6c92
  - >-
    Linux >= 555c0b713ca83968d3c843cb15485b9ba3367b1b <
    41b4320b84fdafe1ab586b06453d30d50415db59
  - >-
    Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf <
    9697db03e010391c55ae75192cbdf30c5a72c114
  - >-
    Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf <
    b584f107ab90222bd825dcb4c5977326ff684109
  - >-
    Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf <
    f08aaee3152d0dfc578b3f2586932d82062701dd
  - Linux 4707ad649cf662add3058bff47430817811b048d
  - Linux >= 6.6.93 < 6.6.145
  - Linux >= 6.12.31 < 6.12.97
  - Linux >= 6.14.9 < 6.15
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:49:46.514218Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:23.555Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72427'
references:
  - url: 'https://git.kernel.org/stable/c/525e408c27ae714e538b8c608c3a974df3ab6c92'
  - url: 'https://git.kernel.org/stable/c/41b4320b84fdafe1ab586b06453d30d50415db59'
  - url: 'https://git.kernel.org/stable/c/9697db03e010391c55ae75192cbdf30c5a72c114'
  - url: 'https://git.kernel.org/stable/c/b584f107ab90222bd825dcb4c5977326ff684109'
  - url: 'https://git.kernel.org/stable/c/f08aaee3152d0dfc578b3f2586932d82062701dd'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.0595
ingestedAt: '2026-10-16T19:46:24.396Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix effective prog array index with BPF_F_PREORDER

replace_effective_prog() and purge_effective_progs() located the slot in
the effective array by walking the program hlist and counting entries
linearly. That count does not match the array layout: compute_effective_
progs() places BPF_F_PREORDER programs at the front (ancestor cgroup
first, attach order within a cgroup) and the rest after them (descendant
cgroup first). So when a preorder program is present, the linear hlist
position no longer equals the program's index in the effective array.

For replace_effective_prog() (bpf_link_update()) this overwrote the
wrong slot, corrupting the effective order. For purge_effective_progs(),
it could dummy out a slot belonging to a different program and leave the
detached program in the array while bpf_prog_put() drops its reference,
i.e. a use-after-free.

Fix both by replaying compute_effective_progs()'s placement (including
the per-cgroup preorder reversal) in a shared effective_prog_pos()
helper. Identify the entry by its struct bpf_prog_list pointer rather
than by (prog, link) value, so the lookup resolves to exactly the
attachment the syscall selected even when the same bpf_prog is attached
to several cgroups in the hierarchy.

## Affected

- `Linux >= bc8023ef3b11410682e5d4990e05e5bc2d3e1c94 < 525e408c27ae714e538b8c608c3a974df3ab6c92`
- `Linux >= 555c0b713ca83968d3c843cb15485b9ba3367b1b < 41b4320b84fdafe1ab586b06453d30d50415db59`
- `Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < 9697db03e010391c55ae75192cbdf30c5a72c114`
- `Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < b584f107ab90222bd825dcb4c5977326ff684109`
- `Linux >= 4b82b181a26cff8bf7adc3a85a88d121d92edeaf < f08aaee3152d0dfc578b3f2586932d82062701dd`
- `Linux 4707ad649cf662add3058bff47430817811b048d`
- `Linux >= 6.6.93 < 6.6.145`
- `Linux >= 6.12.31 < 6.12.97`
- `Linux >= 6.14.9 < 6.15`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.