Linux kernel BPF: conntrack kfuncs write opts->error outside the verifier-checked range

CVSS 8.8CVE-2026-72423Kernel, userspace & hypervisorcurated

Impact

The conntrack lookup and allocation kfuncs validate only the memory range described by opts__sz, but the wrappers wrote opts->error unconditionally on any helper error. With a size smaller than the end of that field, the write lands outside the range the verifier checked - a small out-of-bounds write driven from a loaded BPF program. The fix keeps returning NULL for invalid arguments and only reports through opts->error when the supplied size actually includes the field. On a GPU cluster the reach is the same as any BPF verifier gap: whoever can load programs using these kfuncs, typically CNI dataplanes and observability agents rather than ordinary tenant pods.

Who can reach it

Local actor able to load a BPF program calling the conntrack lookup/alloc kfuncs with an undersized opts__sz - requires CAP_BPF or equivalent. Not reachable remotely and not reachable from a pod without BPF load privileges.

What to do

Move to a stable kernel carrying the guarded write (three stable commits linked) and reboot the affected nodes; this is a kernel-image change. Restricting BPF program loading to trusted components limits exposure until the reboot window. No vendor advisory with fixed versions accompanies the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-72423 https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28 https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0 https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.