Linux Kernel up to 7.1.4/7.2-rc3 BPF Ops io_uring io_install_bpf priv/ring_fd use after free

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.4/7.2-rc3 and classified as very critical. Affected is the function io_install_bpf of the file io_uring of the component BPF Ops. The manipulation of the argument priv/ring_fd results in use after free. This vulnerability is identified as CVE-2026-72112. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.4/7.2-rc3. Affected is the function io_install_bpf of the file io_uring of the component BPF Ops. The manipulation of the argument priv/ring_fd with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: io_uring/bpf-ops: reject re-registration of an already-bound ops io_install_bpf() only rejects a second registration on the ctx side (ctx->bpf_ops) and sets the per-map back-pointer ops->priv unconditionally. The struct_ops link path never advances a map past BPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be registered more than once, and bpf_io_reg() re-resolves the target ring via fget(ops->ring_fd) on every call. A caller can therefore point the same ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE calls. The second registration passes the ctx->bpf_ops check (the new ctx has none) and overwrites ops->priv, orphaning the first ctx. Teardown (io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops->priv, so the orphaned ctx is never torn down: its ctx->loop_step keeps pointing into the struct_ops trampoline, which is freed once the map is gone. A later io_uring_enter() on the orphaned ring then calls the dangling ctx->loop_step from io_run_loop() -- a use-after-free of freed executable memory, reachable by a task with CAP_BPF + CAP_PERFMON. Reject registration when ops->priv is already set, as hid_bpf_reg() does for its struct_ops.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-72112 since 08/09/2026. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc4 eliminates this vulnerability. Applying the patch 0639ea767fe04c288a8d6cb826100fe3d95d4936/3afc64c61ce906a04f073ca350b46de10e8302f9 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion