CVE-2026-72427

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) cgroup program handling. Incorrect indexing in the replace_effective_prog() and purge_effective_progs() functions, particularly when BPF_F_PREORDER programs are active, can lead to memory corruption. This issue can result in overwriting incorrect memory slots or a use-after-free condition, where the system attempts to access memory that has already been deallocated.

This flaw is rated as having a Moderate impact because exploitation requires local access and specialized administrative capabilities to attach and replace cgroup-level BPF programs. Standard unprivileged users cannot modify or detach BPF cgroup links, substantially limiting the attack surface in default Red Hat Enterprise Linux environments. Furthermore, triggering the resulting memory corruption or use-after-free condition requires specific program hierarchy configurations, preventing simple or unprivileged exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.