CVE-2026-72401 bpf: Fix insn_aux_data leak on verifier err_free_env path
A memory leak in the Linux kernel BPF verifier allows local attackers to cause denial of service by exhausting kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72401?
CVE-2026-72401 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix insn_aux_data leak on verifier err_free_env path
When bpf_check() allocates env->insn_aux_data successfully but later fails to allocate env->succ, it jumps directly to err_free_env.
The existing vfree(env->insn_aux_data) sits before the err_free_env label, so that direct jump bypasses it and leaks insn_aux_data.
Move vfree(env->insn_aux_data) into err_free_env so all early and late exit paths release it consistently.
Which versions are affected by CVE-2026-72401?
How do I fix CVE-2026-72401?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72401 being exploited?
There is no known exploitation of CVE-2026-72401 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-72401, GHSA-f5wx-qgf8-mmv9, UBUNTU-CVE-2026-72401.