« Volver al listado

CVE-2026-72426

Estado: RecibidaAlta (8.4)—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer spill metadata during half-slot cleanup

__clean_func_state() cleans dead stack slots in 4-byte halves. When the high half of a STACK_SPILL slot is dead and the low half remains live, cleanup converts the live low half to STACK_MISC or STACK_ZERO and clears the saved spilled_ptr metadata.

That conversion is safe only for scalar spills. For a pointer spill, this metadata clear lets a later 32-bit fill from the still-live half avoid the normal non-scalar register-fill check and be treated as an ordinary scalar stack read.

Leer descripción completaMostrar menos

Leave non-scalar spill slots intact in this half-live shape. This is conservative for pruning and preserves the existing check_stack_read_fixed_off() rejection path for partial fills from pointer spills.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local (AV:L/PR:N/UI:N) sin interacción permite escalada de privilegios mediante manipulación de metadatos de spill en BPF; ejecución de código en el kernel sin interacción del usuario.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72426",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "be23266b4a08540aa43d8503a2ea10247c8daebe",
              "lessThan": "0f9278b22cda6fd2525049930157b79b4036b4ef",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be23266b4a08540aa43d8503a2ea10247c8daebe",
              "lessThan": "3a354149bceacadbcf7d7b4766f5ef26a85892ab",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/bpf/states.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/states.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:16.427",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0f9278b22cda6fd2525049930157b79b4036b4ef",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3a354149bceacadbcf7d7b4766f5ef26a85892ab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer spill metadata during half-slot cleanup\n\n__clean_func_state() cleans dead stack slots in 4-byte halves. When the\nhigh half of a STACK_SPILL slot is dead and the low half remains live,\ncleanup converts the live low half to STACK_MISC or STACK_ZERO and clears\nthe saved spilled_ptr metadata.\n\nThat conversion is safe only for scalar spills. For a pointer spill, this\nmetadata clear lets a later 32-bit fill from the still-live half avoid the\nnormal non-scalar register-fill check and be treated as an ordinary scalar\nstack read.\n\nLeave non-scalar spill slots intact in this half-live shape. This is\nconservative for pruning and preserves the existing\ncheck_stack_read_fixed_off() rejection path for partial fills from pointer\nspills."
    }
  ],
  "lastModified": "2026-08-17T06:19:09.873",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}