CVE-2026-72423
In the Linux kernel, the following vulnerability has been resolved:
bpf: Guard conntrack opts error writes
The conntrack lookup and allocation kfuncs take an opts pointer
together with an optssz argument. The verifier checks only the memory
range described by optssz, but the wrappers unconditionally write
opts->error whenever the internal lookup or allocation helper returns an
error.
For an invalid size smaller than the end of opts->error, that write can
land outside the verifier-checked range. Keep returning NULL for invalid
arguments, but only report the error through opts->error when the
supplied size includes the field.
This preserves error reporting for the supported 12-byte and 16-byte
layouts, and for other invalid sizes that still include opts->error.
CSIRTS triage
- What
- BPF engine guards writes to conntrack options error paths to prevent unsafe memory access.
- Who is affected
- Linux systems with BPF conntrack offloading enabled.
- Urgency
- Medium urgency; unguarded error writes could lead to memory corruption via BPF programs.
- Action
- Apply kernel patch that guards conntrack options error writes.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-72423
Get an email if CVE-2026-72423 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
Advisory coverage (2)
- highCVE-2026-72423: In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts …nvd · 2026-08-15
- mediumCVE-2026-72423: bpf: Guard conntrack opts error writesmsrc · 2026-08-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-72423)