Bug 2516479 (CVE-2026-72426)

Summary:	CVE-2026-72426 kernel: bpf: Preserve pointer spill metadata during half-slot cleanup
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. The `__clean_func_state()` function, which manages stack slot cleanup, incorrectly clears metadata for pointer spills. This allows a subsequent read from a partially live stack slot to bypass crucial non-scalar register-fill checks, treating a pointer as a scalar value. This vulnerability could lead to a security bypass, potentially enabling information disclosure or other memory corruption issues.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:14:40 UTC

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer spill metadata during half-slot cleanup

__clean_func_state() cleans dead stack slots in 4-byte halves. When the
high half of a STACK_SPILL slot is dead and the low half remains live,
cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears
the saved spilled_ptr metadata.

That conversion is safe only for scalar spills. For a pointer spill, this
metadata clear lets a later 32-bit fill from the still-live half avoid the
normal non-scalar register-fill check and be treated as an ordinary scalar
stack read.

Leave non-scalar spill slots intact in this half-live shape. This is
conservative for pruning and preserves the existing
check_stack_read_fixed_off() rejection path for partial fills from pointer
spills.

Comment 1 gkamathe 2026-08-18 13:12:31 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72426-8fec@gregkh/T