CVE-2026-72428

A flaw was found in the Berkeley Packet Filter (BPF) component of the Linux kernel. An incorrect calculation of the stack slot index during Spectre v4 sanitization checks could result in certain memory bytes not being properly sanitized. This vulnerability might allow an attacker to potentially disclose sensitive information through speculative execution side-channel attacks.

A moderate information disclosure flaw was found in the Berkeley Packet Filter (BPF) verifier of the Linux kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2. When checking fixed-offset stack writes, check_stack_write_fixed_off() computes the byte slot as -off - 1 and records each written byte in slot_type[] using (slot - i) % BPF_REG_SIZE, but the Spectre v4 (speculative store bypass) sanitization pre-check reads slot_type[i] instead. For a partial write, such as a 4-byte write at fp-8 after the lower half of the slot has been zeroed, the pre-check scans the wrong bytes and may leave the overwritten stack bytes without nospec_result sanitization. A local attacker able to load a crafted BPF program, which typically requires CAP_BPF/CAP_SYS_ADMIN or an environment where unprivileged BPF is enabled, could potentially exploit this gap to disclose sensitive kernel stack data through a Spectre v4 speculative-execution side-channel attack. Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt) and the RHEL 8.4 streams are not affected because the vulnerable code is not present there; the affected code first appeared in RHEL 8.5. The flaw has been assessed as moderate because exploitation requires local access, BPF program-loading capability, and a complex, timing-dependent side channel, so practical exploitability is limited. Based on this limited practical exposure, the fix has been deferred and will be delivered in a future scheduled kernel update rather than an immediate security update; the residual risk until then is potential local disclosure of unsanitized kernel stack memory through a Spectre v4 side channel by an attacker with the ability to load crafted BPF programs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.