{"id":"CVE-2026-72423","state":"PUBLISHED","title":"bpf: Guard conntrack opts error writes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts->error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts->error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts->error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts->error.","publishedAt":"2026-08-15T05:56:41.711Z","updatedAt":"2026-10-30T12:29:22.084Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"6fd973def4d6cb89aaf7e9b6bc26cac977f6da13","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"669bc3b345712112d3f033a1953f5a10b15e7c65","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"63d95c6bbd6fc0e411404188306a1fea456300b0","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"453f4f1e90de55b6bc297936031b68bef93f2e28","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"dd74c80203842a21b2ebb9f70d1260d9aa20fa05","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"6f6183a39533d727deaa5061cadae6dd9e6744d0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]}],"references":["https://git.kernel.org/stable/c/6fd973def4d6cb89aaf7e9b6bc26cac977f6da13","https://git.kernel.org/stable/c/669bc3b345712112d3f033a1953f5a10b15e7c65","https://git.kernel.org/stable/c/63d95c6bbd6fc0e411404188306a1fea456300b0","https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28","https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05","https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0"],"weaknesses":[],"ingestedAt":"2026-10-30T12:48:04.825Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72423.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72423","state":"PUBLISHED","datePublished":"2026-08-15T05:56:41.711Z","dateUpdated":"2026-10-30T12:29:22.084Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.928Z"},"containers":{"cna":{"title":"bpf: Guard conntrack opts error writes","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts->error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts->error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts->error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts->error."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"6fd973def4d6cb89aaf7e9b6bc26cac977f6da13","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"669bc3b345712112d3f033a1953f5a10b15e7c65","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"63d95c6bbd6fc0e411404188306a1fea456300b0","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"453f4f1e90de55b6bc297936031b68bef93f2e28","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"dd74c80203842a21b2ebb9f70d1260d9aa20fa05","versionType":"git"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","status":"affected","lessThan":"6f6183a39533d727deaa5061cadae6dd9e6744d0","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/nf_conntrack_bpf.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6fd973def4d6cb89aaf7e9b6bc26cac977f6da13"},{"url":"https://git.kernel.org/stable/c/669bc3b345712112d3f033a1953f5a10b15e7c65"},{"url":"https://git.kernel.org/stable/c/63d95c6bbd6fc0e411404188306a1fea456300b0"},{"url":"https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28"},{"url":"https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05"},{"url":"https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires loading and attaching a BPF XDP or TC program that calls the conntrack kfuncs via the bpf() syscall; per kernel CNA guidance BPF/netfilter paths are Local even when programs later run on network packets.\nAC:L - An attacker reliably triggers the bug by calling bpf_xdp_ct_lookup/alloc or bpf_skb_ct_lookup/alloc with opts__sz smaller than the error field (e.g. 4); the helper returns EINVAL and the wrapper performs the out-of-bounds write with no races or attacker-uncontrollable conditions.\nPR:L - Loading BPF_PROG_TYPE_XDP or BPF_PROG_TYPE_SCHED_CLS programs requires CAP_NET_ADMIN, which unprivileged users can obtain inside user/network namespaces (unshare -Urn) on typical Linux deployments without init-namespace root.\nUI:N - No victim interaction is required; the attacker loads their own BPF program and invokes the kfunc with a small opts__sz to trigger the out-of-bounds write on demand.\nS:C - Corrupting kernel memory via a verifier-bypassing BPF stack write from a user/network namespace can cross the namespace/container trust boundary to compromise the host kernel, exceeding the attacker's original security scope.\nC:H - The bug is a controlled 4-byte out-of-bounds write past the verifier-approved opts buffer on the BPF stack, a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Writing opts->error outside the verifier-checked range corrupts adjacent BPF stack slots with attacker-influenced errno values, enabling heap/stack grooming and control-flow hijacking toward arbitrary kernel code execution.\nA:H - Corrupting BPF stack memory outside verifier bounds can cause immediate kernel oops/panic or be used in a repeatable crash/DoS loop when the attached XDP/TC program runs on incoming traffic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:29:22.084Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72423","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:49:41.501757Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:23.252Z"}}]}}}