{"id":"CVE-2026-72426","summary":"bpf: Preserve pointer spill metadata during half-slot cleanup","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer spill metadata during half-slot cleanup\n\n__clean_func_state() cleans dead stack slots in 4-byte halves. When the\nhigh half of a STACK_SPILL slot is dead and the low half remains live,\ncleanup converts the live low half to STACK_MISC or STACK_ZERO and clears\nthe saved spilled_ptr metadata.\n\nThat conversion is safe only for scalar spills. For a pointer spill, this\nmetadata clear lets a later 32-bit fill from the still-live half avoid the\nnormal non-scalar register-fill check and be treated as an ordinary scalar\nstack read.\n\nLeave non-scalar spill slots intact in this half-live shape. This is\nconservative for pruning and preserves the existing\ncheck_stack_read_fixed_off() rejection path for partial fills from pointer\nspills.","modified":"2026-08-16T03:48:41.440678814Z","published":"2026-08-15T05:56:43.575Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72426.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0f9278b22cda6fd2525049930157b79b4036b4ef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3a354149bceacadbcf7d7b4766f5ef26a85892ab"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72426.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72426"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"be23266b4a08540aa43d8503a2ea10247c8daebe"},{"fixed":"0f9278b22cda6fd2525049930157b79b4036b4ef"},{"fixed":"3a354149bceacadbcf7d7b4766f5ef26a85892ab"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72426.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72426.json"}}],"schema_version":"1.9.0"}