CVE-2026-72423bpf: Guard conntrack opts error writes
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal lookup or allocation helper returns an error. For an invalid size smaller than the end of opts->error, that write can land outside the verifier-checked range. Keep returning NULL for invalid arguments, but only report the error through opts->error when the supplied size includes the field. This preserves error reporting for the supported 12-byte and 16-byte layouts, and for other invalid sizes that still include opts->error.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 before 453f4f1e90de55b6bc297936031b68bef93f2e28; from b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 before dd74c80203842a21b2ebb9f70d1260d9aa20fa05; from b4c2b9593a1c4c3a718370e34af28e817fd5e5c6 before 6f6183a39533d727deaa5061cadae6dd9e6744d0 | CNA record |
References
- https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28
- https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05
- https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.