CVE-2026-72112

A flaw was found in the Linux kernel's io_uring/bpf-ops component. This vulnerability allows a local attacker with specific capabilities (CAP_BPF and CAP_PERFMON) to re-register an already-bound operation, leading to a use-after-free of freed executable memory. This could result in arbitrary code execution.

Red Hat has evaluated this issue as having Moderate impact because triggering the flaw requires local execution under elevated privileges, specifically demanding CAP_BPF and CAP_PERFMON capabilities. The flaw resides in io_uring BPF struct_ops management, which is not present in supported Red Hat Enterprise Linux kernels. Consequently, standard Red Hat enterprise environments are not exposed to this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.