CVE-2026-72110

In the Linux kernel, the following vulnerability has been resolved:

bpf,fork: wipe ->bpf_storage before bailouts that access it

Currently, copyprocess() can bail out to freetask() before p->bpfstorage has been initialized, with this call graph (shown here for the !CONFIGMEMCG case):

copyprocess duptaskstruct archduptaskstruct [copies the entire taskstruct, including ->bpfstorage member] [RLIMITNPROC check fails] delayedfreetask freetask bpftaskstoragefree rcudereference(task->bpfstorage) bpflocalstoragedestroy

In this case, the nascent task's ->bpfstorage member that bpflocalstoragedestroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF).

This is reachable as long as the process calling fork() has been inserted into a task storage map.