GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72112 (GCVE-0-2026-72112)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:40
VLAI
Title
io_uring/bpf-ops: reject re-registration of an already-bound ops
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/bpf-ops: reject re-registration of an already-bound ops io_install_bpf() only rejects a second registration on the ctx side (ctx->bpf_ops) and sets the per-map back-pointer ops->priv unconditionally. The struct_ops link path never advances a map past BPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be registered more than once, and bpf_io_reg() re-resolves the target ring via fget(ops->ring_fd) on every call. A caller can therefore point the same ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE calls. The second registration passes the ctx->bpf_ops check (the new ctx has none) and overwrites ops->priv, orphaning the first ctx. Teardown (io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops->priv, so the orphaned ctx is never torn down: its ctx->loop_step keeps pointing into the struct_ops trampoline, which is freed once the map is gone. A later io_uring_enter() on the orphaned ring then calls the dangling ctx->loop_step from io_run_loop() -- a use-after-free of freed executable memory, reachable by a task with CAP_BPF + CAP_PERFMON. Reject registration when ops->priv is already set, as hid_bpf_reg() does for its struct_ops.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98f37634b12b17ad5c56db8fb63cf9d7dc55d74c , < 0639ea767fe04c288a8d6cb826100fe3d95d4936 (git)
Affected: 98f37634b12b17ad5c56db8fb63cf9d7dc55d74c , < 3afc64c61ce906a04f073ca350b46de10e8302f9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/bpf-ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0639ea767fe04c288a8d6cb826100fe3d95d4936",
              "status": "affected",
              "version": "98f37634b12b17ad5c56db8fb63cf9d7dc55d74c",
              "versionType": "git"
            },
            {
              "lessThan": "3afc64c61ce906a04f073ca350b46de10e8302f9",
              "status": "affected",
              "version": "98f37634b12b17ad5c56db8fb63cf9d7dc55d74c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/bpf-ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/bpf-ops: reject re-registration of an already-bound ops\n\nio_install_bpf() only rejects a second registration on the ctx side\n(ctx-\u003ebpf_ops) and sets the per-map back-pointer ops-\u003epriv\nunconditionally. The struct_ops link path never advances a map past\nBPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be\nregistered more than once, and bpf_io_reg() re-resolves the target ring\nvia fget(ops-\u003ering_fd) on every call. A caller can therefore point the\nsame ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE\ncalls.\n\nThe second registration passes the ctx-\u003ebpf_ops check (the new ctx has\nnone) and overwrites ops-\u003epriv, orphaning the first ctx. Teardown\n(io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops-\u003epriv, so\nthe orphaned ctx is never torn down: its ctx-\u003eloop_step keeps pointing\ninto the struct_ops trampoline, which is freed once the map is gone. A\nlater io_uring_enter() on the orphaned ring then calls the dangling\nctx-\u003eloop_step from io_run_loop() -- a use-after-free of freed\nexecutable memory, reachable by a task with CAP_BPF + CAP_PERFMON.\n\nReject registration when ops-\u003epriv is already set, as hid_bpf_reg()\ndoes for its struct_ops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local bpf() syscalls (BPF_MAP_CREATE/UPDATE_ELEM, BPF_PROG_LOAD, BPF_LINK_CREATE) and io_uring_setup/io_uring_enter on an orphaned ring; per kernel guidance io_uring and BPF are Local attack vectors with no remote packet path.\nAC:L - Exploitation is fully deterministic and attacker-controlled: create two DEFER_TASKRUN rings, link the same struct_ops map twice after dup2 repointing ring_fd, free the map/link, then io_uring_enter on the orphaned ring; no race or conditions outside attacker control are required.\nPR:L - The commit requires CAP_BPF and CAP_PERFMON, but bpf_token_capable() can delegate these into non-init user namespaces via BPF tokens in containerized deployments, and io_uring is commonly available to local users; under uncertainty this is scored Low rather than High.\nUI:N - No victim interaction is needed; once the attacker has BPF and io_uring access they can perform every setup, teardown, and triggering step themselves without any other user opening files or taking action.\nS:U - Impact is confined to kernel memory and execution within the same kernel security authority (standard local privilege-escalation/memory-corruption class), not a VM escape, IOMMU bypass, or other cross-scope boundary.\nC:H - Orphaned ctx-\u003eloop_step retains a pointer into a freed BPF struct_ops trampoline page; executing or dereferencing that UAF can expose reclaimed slab contents and supports building arbitrary read primitives, so confidentiality impact is High per UAF guidance.\nI:H - The dangling loop_step calls freed executable trampoline memory from io_run_loop(); with heap grooming an attacker can reclaim those pages with controlled contents, enabling control-flow hijack and arbitrary kernel write, so integrity impact is High.\nA:H - Invoking the dangling ctx-\u003eloop_step after trampoline teardown causes use-after-free of executable kernel memory during io_uring_enter, which can reliably trigger kernel oops, BUG, or panic and is repeatable on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:26.740Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0639ea767fe04c288a8d6cb826100fe3d95d4936"
        },
        {
          "url": "https://git.kernel.org/stable/c/3afc64c61ce906a04f073ca350b46de10e8302f9"
        }
      ],
      "title": "io_uring/bpf-ops: reject re-registration of an already-bound ops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72112",
    "datePublished": "2026-08-15T05:52:53.275Z",
    "dateReserved": "2026-08-09T03:40:39.906Z",
    "dateUpdated": "2026-08-17T05:40:26.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72112",
      "date": "2026-09-19",
      "epss": "0.00154",
      "percentile": "0.04923"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "io_uring/bpf-ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0639ea767fe04c288a8d6cb826100fe3d95d4936",
                    "status": "affected",
                    "version": "98f37634b12b17ad5c56db8fb63cf9d7dc55d74c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3afc64c61ce906a04f073ca350b46de10e8302f9",
                    "status": "affected",
                    "version": "98f37634b12b17ad5c56db8fb63cf9d7dc55d74c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "io_uring/bpf-ops.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/bpf-ops: reject re-registration of an already-bound ops\n\nio_install_bpf() only rejects a second registration on the ctx side\n(ctx-\u003ebpf_ops) and sets the per-map back-pointer ops-\u003epriv\nunconditionally. The struct_ops link path never advances a map past\nBPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be\nregistered more than once, and bpf_io_reg() re-resolves the target ring\nvia fget(ops-\u003ering_fd) on every call. A caller can therefore point the\nsame ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE\ncalls.\n\nThe second registration passes the ctx-\u003ebpf_ops check (the new ctx has\nnone) and overwrites ops-\u003epriv, orphaning the first ctx. Teardown\n(io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops-\u003epriv, so\nthe orphaned ctx is never torn down: its ctx-\u003eloop_step keeps pointing\ninto the struct_ops trampoline, which is freed once the map is gone. A\nlater io_uring_enter() on the orphaned ring then calls the dangling\nctx-\u003eloop_step from io_run_loop() -- a use-after-free of freed\nexecutable memory, reachable by a task with CAP_BPF + CAP_PERFMON.\n\nReject registration when ops-\u003epriv is already set, as hid_bpf_reg()\ndoes for its struct_ops."
          }
        ],
        "id": "CVE-2026-72112",
        "lastModified": "2026-08-17T06:18:10.417",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:25.563",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0639ea767fe04c288a8d6cb826100fe3d95d4936"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3afc64c61ce906a04f073ca350b46de10e8302f9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T22:44:54+00:00",
      "cve": "CVE-2026-72112",
      "id": "CVE-2026-72112",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: io_uring/bpf-ops: reject re-registration of an already-bound ops",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72112.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:40:32Z",
      "cve": "CVE-2026-72112",
      "id": "CVE-2026-72112",
      "initial_release_date": "2026-08-28T16:40:32Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72112",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72112.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.