« Volver al listado

CVE-2026-72428

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stack slot index in nospec checks

check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE.

The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization.

Leer descripción completaMostrar menos

Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72428",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0e9280654aa482088ee6ef3deadef331f5ac5fb0",
              "lessThan": "e62268e695075a481a6c4feeb022c19cf57422a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "a71eb8f730a91271cf47ce291e785b6b7e54622f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "ca119656baa8f48a56e0c2f3ab63fdd33ca9e307",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "475405593de2b796224c6297aece44f321195919",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "f1471aa76d74e0df3b2a90731ca0208f498c670b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "68b41e68a62299f26cb16af422b5c7d1c69dafd9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "db8f1dcf5950b91886b9df4270bc816370d292c1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "lessThan": "d1d53aa30ab3b5ae89161c9cc840b3f7489ad386",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "872968502114d68c21419cf7eb5ab97717e7b803",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5893af2704eb763eb982f01d573f5b19f06b623",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b27bdf02c400684225ee5ee99970bcbf5082282",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.10.56",
              "lessThan": "5.10.261",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.19.207",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.146",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.13.8",
              "lessThan": "5.14",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:22:16.637",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/475405593de2b796224c6297aece44f321195919",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/68b41e68a62299f26cb16af422b5c7d1c69dafd9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a71eb8f730a91271cf47ce291e785b6b7e54622f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ca119656baa8f48a56e0c2f3ab63fdd33ca9e307",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d1d53aa30ab3b5ae89161c9cc840b3f7489ad386",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/db8f1dcf5950b91886b9df4270bc816370d292c1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e62268e695075a481a6c4feeb022c19cf57422a6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f1471aa76d74e0df3b2a90731ca0208f498c670b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack slot index in nospec checks\n\ncheck_stack_write_fixed_off() computes the byte slot for a fixed-offset\nstack write as -off - 1, and records each written byte in slot_type[] with\n(slot - i) % BPF_REG_SIZE.\n\nThe Spectre v4 sanitization pre-check uses slot_type[i] instead. For a\n4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the\npre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates\nbytes 7..4. That can leave the second half-slot write without nospec_result\neven though the bytes being overwritten still require sanitization.\n\nUse the same slot index in the sanitization pre-check that the write path uses\nwhen updating slot_type[]."
    }
  ],
  "lastModified": "2026-08-17T06:19:10.130",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}