CVE-2026-72427: bpf: Fix effective prog array index with BPF_F_PREORDER

CVE-2026-72427: bpf: Fix effective prog array index with BPF_F_PREORDER

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix effective prog array index with BPF_F_PREORDER

replace_effective_prog() and purge_effective_progs() located the slot in
the effective array by walking the program hlist and counting entries
linearly. That count does not match the array layout: compute_effective_
progs() places BPF_F_PREORDER programs at the front (ancestor cgroup
first, attach order within a cgroup) and the rest after them (descendant
cgroup first). So when a preorder program is present, the linear hlist
position no longer equals the program's index in the effective array.

For replace_effective_prog() (bpf_link_update()) this overwrote the
wrong slot, corrupting the effective order. For purge_effective_progs(),
it could dummy out a slot belonging to a different program and leave the
detached program in the array while bpf_prog_put() drops its reference,
i.e. a use-after-free.

Fix both by replaying compute_effective_progs()'s placement (including
the per-cgroup preorder reversal) in a shared effective_prog_pos()
helper. Identify the entry by its struct bpf_prog_list pointer rather
than by (prog, link) value, so the lookup resolves to exactly the
attachment the syscall selected even when the same bpf_prog is attached
to several cgroups in the hierarchy.

The Linux kernel CVE team has assigned CVE-2026-72427 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.93 with commit bc8023ef3b11410682e5d4990e05e5bc2d3e1c94 and fixed in 6.6.145 with commit 525e408c27ae714e538b8c608c3a974df3ab6c92
	Issue introduced in 6.12.31 with commit 555c0b713ca83968d3c843cb15485b9ba3367b1b and fixed in 6.12.97 with commit 41b4320b84fdafe1ab586b06453d30d50415db59
	Issue introduced in 6.15 with commit 4b82b181a26cff8bf7adc3a85a88d121d92edeaf and fixed in 6.18.40 with commit 9697db03e010391c55ae75192cbdf30c5a72c114
	Issue introduced in 6.15 with commit 4b82b181a26cff8bf7adc3a85a88d121d92edeaf and fixed in 7.1.5 with commit b584f107ab90222bd825dcb4c5977326ff684109
	Issue introduced in 6.15 with commit 4b82b181a26cff8bf7adc3a85a88d121d92edeaf and fixed in 7.2-rc1 with commit f08aaee3152d0dfc578b3f2586932d82062701dd
	Issue introduced in 6.14.9 with commit 4707ad649cf662add3058bff47430817811b048d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72427
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/cgroup.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/525e408c27ae714e538b8c608c3a974df3ab6c92
	https://git.kernel.org/stable/c/41b4320b84fdafe1ab586b06453d30d50415db59
	https://git.kernel.org/stable/c/9697db03e010391c55ae75192cbdf30c5a72c114
	https://git.kernel.org/stable/c/b584f107ab90222bd825dcb4c5977326ff684109
	https://git.kernel.org/stable/c/f08aaee3152d0dfc578b3f2586932d82062701dd