CVE-2026-72423

A flaw was found in the Linux kernel. The BPF (Berkeley Packet Filter) subsystem's conntrack (connection tracking) functionality contains an out-of-bounds write vulnerability. This occurs because the system does not properly validate the size of an options structure when reporting errors in conntrack lookup and allocation kernel functions (kfuncs). An attacker could potentially exploit this by providing an invalid size, leading to memory corruption.

A moderate out-of-bounds write vulnerability was found in the Linux kernel's BPF conntrack lookup and allocation kfuncs. These kfuncs take an options pointer together with a size (opts__sz), and the BPF verifier checks only the memory range described by that size; however, the wrapper functions unconditionally wrote the opts->error field whenever the internal lookup or allocation helper returned an error. A local attacker with the ability to load and run an XDP or TC-BPF program that invokes these kfuncs could pass an invalid options size smaller than the end of opts->error, causing the error write to land outside the verifier-checked range. This results in kernel memory corruption, most concretely a system crash or denial of service.

The affected conntrack lookup helpers are present only in the RHEL 9 kernel and kernel-rt (RHEL 9.2 through 9.9 update streams). RHEL 6, 7, 8, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels.

The fix for the affected RHEL 9 streams is deferred to a future update. The residual risk is limited because exploitation requires local access and the privileges needed to load BPF programs that call the affected conntrack kfuncs; network traffic alone cannot trigger the flaw.

Red Hat Product Security rates this issue Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the CVE.org record rates it 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The difference reflects that Red Hat found no established path to confidentiality or integrity impact and considers the primary consequence to be a loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.