CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reset register bounds before narrowing retval range in check_mem_access()

When the BPF verifier processes a context load of an LSM hook return
value, it calls __mark_reg_s32_range() to narrow the register to the
hook's valid range. However, __mark_reg_s32_range() intersects the new
range with the register's existing bounds using max_t()/min_t() rather
than replacing them.

If the destination register carries stale bounds from a prior instruction
(e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than
reality. The verifier then believes it knows the register's exact value,
while at runtime the actual hook return value is loaded, creating a
verifier/runtime mismatch that can be used to bypass BPF memory safety
checks.

The else branch already calls mark_reg_unknown() to reset register state
before any narrowing. Apply the same reset in the is_retval path so
stale bounds are cleared before __mark_reg_s32_range() intersects.

The Linux kernel CVE team has assigned CVE-2026-72111 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 and fixed in 6.12.103 with commit bde92f65042ec14389782dd223f706bf6b59ce5d
	Issue introduced in 6.12 with commit 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 and fixed in 6.18.40 with commit 0993dc5fc619c0b25ab1310cb11d65e78351c0fe
	Issue introduced in 6.12 with commit 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 and fixed in 7.1.5 with commit 5a55f9aecc08990940e70f0c7048a80850c5a16a
	Issue introduced in 6.12 with commit 5d99e198be279045e6ecefe220f5c52f8ce9bfd5 and fixed in 7.2-rc1 with commit 5e0b273e0a62cc04ec338c7b502797c66c2ed42a
	Issue introduced in 6.10.13 with commit 1050727d83e70449991c29dd1cf29fe936a63da3
	Issue introduced in 6.11.2 with commit 27ca3e20fe80be85a92b10064dfeb56cb2564b1c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72111
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/verifier.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bde92f65042ec14389782dd223f706bf6b59ce5d
	https://git.kernel.org/stable/c/0993dc5fc619c0b25ab1310cb11d65e78351c0fe
	https://git.kernel.org/stable/c/5a55f9aecc08990940e70f0c7048a80850c5a16a
	https://git.kernel.org/stable/c/5e0b273e0a62cc04ec338c7b502797c66c2ed42a