CVE-2026-72419 in Linux
Zusammenfassung
von VulDB • 15.08.2026
Based on the stack trace provided, here is an analysis of what is happening and why you are seeing this "red horder" error.
### 1. What is happening? The kernel has triggered **KASAN (Kernel Address Sanitizer)** or a similar memory safety check. The specific function `__sanitizer_cov_trace_switch` indicates that the sanitizer detected an invalid access during a switch-case statement execution, likely involving array indexing based on user-controlled input.
### 2. Why is it called a "red herring"? The message states: *"The out-of-bounds report, though, is a red herring..."* This usually means one of two things in the context of Linux kernel debugging with KASAN/KCSAN/UBSAN:
- **False Positive due to Memory Corruption:** The actual bug might be an earlier memory corruption (e.g., use-after-free, double free, or heap overflow) that corrupted a pointer or length field. When the code later tries to access this corrupted data in a switch statement (`__sanitizer_cov_trace_switch`), it appears as an out-of-bounds read/write, but the *root cause* is earlier in the call chain. - **Sanitizer Overhead/Noise:** Sometimes KASAN reports can be noisy or report secondary effects of a primary bug (like a NULL pointer dereference that leads to invalid memory access later).
### 3. Key Functions in the Stack Trace Let’s break down the relevant parts:
| Function | Role | Significance | |----------|------|--------------| | `entry_SYSCALL_64_safe_stack` → `do_syscall_64` | Entry point for system calls | The bug was triggered by a user-space syscall. | | `__sys_sendmsg` → `____sys_sendmsg` | Sending messages via sockets | Indicates the trigger is likely sending data over a socket (possibly netlink). | | `netlink_sendmsg` → `nfnetlink_rcv` | Netlink message handling | The system call was sent to **Netlink**, specifically triggering an **NFNetlink** handler. This suggests you are interacting with kernel networking subsystems (e.g., iptables, conntrack, or custom netlink modules). | | `gr_acl_handle_mmap+0x1c4/0x320` | Custom module function? | The prefix `gr_` is not standard Linux kernel. This likely belongs to a **custom out-of-tree driver/module** (e.g., "GuardRails", "Galois Research", or an internal company module). This is the most suspicious part — it’s where your custom code handles memory mapping (`mmap`). | | `__sanitizer_cov_trace_switch+0x63/0xe0` | KASAN instrumentation | The sanitizer detected invalid access inside a switch statement. This often happens when indexing into an array using untrusted input (e.g., from netlink attributes). |
### 4. Likely Root Cause Given the presence of `gr_acl_handle_mmap`, here’s what likely happened:
1. A user-space process sent a Netlink message (`sendmsg`). 2. The kernel routed it to an NFNetlink handler, which eventually called into your custom module (`gr_acl_handle_mmap`). 3. Inside `gr_acl_handle_mmap` (or a function it calls), there is likely: - A **switch statement** that uses input from the netlink message as an index. - The value used for indexing was **out of bounds**, causing KASAN to flag it. 4. However, if this is truly a "red herring," the real issue might be: - An earlier buffer overflow in `gr_acl_handle_mmap` that corrupted adjacent memory (e.g., the array being indexed). - A use-after-free where the data structure was already freed before the switch statement.
### 5. How to Debug Further To find the *real* bug, do not focus solely on the out-of-bounds report in `__sanitizer_cov_trace_switch`. Instead:
1. **Look at Earlier Logs:** Check dmesg for any prior warnings (e.g., "BUG: unable to handle kernel paging request", "slab corruption", or other KASAN reports) that occurred *before* this stack trace. 2. **Inspect `gr_acl_handle_mmap`:** - Look at the code around offset `0x1c4` in `gr_acl_handle_mmap`. - Identify any switch statements or array accesses based on user input (from netlink attributes). - Ensure all indices are validated against bounds *before* use. 3. **Check Netlink Attribute Parsing:** The function `nla_get_range_signed` and `__nla_parse` appear in the stack. Verify that you correctly parse and validate all netlink attributes before
Once again VulDB remains the best source for vulnerability data.