CVE-2026-72402

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier logging mechanism. The print_bpf_insn() function, responsible for masking sensitive pointer values in verifier logs, did not correctly mask all pseudo-pointer types. This oversight could lead to kernel memory addresses being exposed in the verifier logs, potentially allowing an attacker to gain sensitive information about the kernel's memory layout.

A moderate information disclosure flaw was found in the Linux kernel BPF (Berkeley Packet Filter) verifier logging. The print_bpf_insn() function is responsible for masking sensitive pointer values in verifier log output when pointer leaks are not allowed, but it only masked the BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE pseudo sources. The BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID pseudo sources can also be resolved to kernel pointer values before the verifier log prints the instruction, so the log could expose kernel memory addresses. A local user able to load a BPF program and read the verifier log could use this to obtain sensitive information about the kernel's memory layout, weakening KASLR-based protections and potentially assisting the exploitation of other kernel vulnerabilities. The kernel and kernel-rt packages in the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS update streams are affected; Red Hat Enterprise Linux 6 ELS, 7 ELS, and the 8.4 update stream are not affected because the vulnerable code is not present in those versions. Because this flaw only discloses kernel address information through verifier log output and requires local access with the ability to load BPF programs, the fix has been deferred for the affected streams and will be addressed in a future scheduled kernel update; the residual risk is limited to exposure of kernel address information.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.