Answer in brief
CVE-2026-72428 records a Unknown severity vulnerability in bpf: Fix stack slot index in nospec checks. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72428 records a Unknown severity vulnerability in bpf: Fix stack slot index in nospec checks. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0e9280654aa482088ee6ef3deadef331f5ac5fb0 <e62268e695075a481a6c4feeb022c19cf57422a6 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <a71eb8f730a91271cf47ce291e785b6b7e54622f || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <ca119656baa8f48a56e0c2f3ab63fdd33ca9e307 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <475405593de2b796224c6297aece44f321195919 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <f1471aa76d74e0df3b2a90731ca0208f498c670b || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <68b41e68a62299f26cb16af422b5c7d1c69dafd9 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <db8f1dcf5950b91886b9df4270bc816370d292c1 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <d1d53aa30ab3b5ae89161c9cc840b3f7489ad386 || 872968502114d68c21419cf7eb5ab97717e7b803 || f5893af2704eb763eb982f01d573f5b19f06b623 || 0b27bdf02c400684225ee5ee99970bcbf5082282 || >=5.10.56 <5.10.261 || >=4.19.207 <4.20 || >=5.4.146 <5.5 || >=5.13.8 <5.14 | e62268e695075a481a6c4feeb022c19cf57422a6, a71eb8f730a91271cf47ce291e785b6b7e54622f, ca119656baa8f48a56e0c2f3ab63fdd33ca9e307, 475405593de2b796224c6297aece44f321195919, f1471aa76d74e0df3b2a90731ca0208f498c670b, 68b41e68a62299f26cb16af422b5c7d1c69dafd9, db8f1dcf5950b91886b9df4270bc816370d292c1, d1d53aa30ab3b5ae89161c9cc840b3f7489ad386, 5.10.261, 4.20, 5.5, 5.14 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0e9280654aa482088ee6ef3deadef331f5ac5fb0 <e62268e695075a481a6c4feeb022c19cf57422a6 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <a71eb8f730a91271cf47ce291e785b6b7e54622f || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <ca119656baa8f48a56e0c2f3ab63fdd33ca9e307 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <475405593de2b796224c6297aece44f321195919 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <f1471aa76d74e0df3b2a90731ca0208f498c670b || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <68b41e68a62299f26cb16af422b5c7d1c69dafd9 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <db8f1dcf5950b91886b9df4270bc816370d292c1 || >=2039f26f3aca5b0e419b98f65dd36481337b86ee <d1d53aa30ab3b5ae89161c9cc840b3f7489ad386 || 872968502114d68c21419cf7eb5ab97717e7b803 || f5893af2704eb763eb982f01d573f5b19f06b623 || 0b27bdf02c400684225ee5ee99970bcbf5082282 || >=5.10.56 <5.10.261 || >=4.19.207 <4.20 || >=5.4.146 <5.5 || >=5.13.8 <5.14 | e62268e695075a481a6c4feeb022c19cf57422a6, a71eb8f730a91271cf47ce291e785b6b7e54622f, ca119656baa8f48a56e0c2f3ab63fdd33ca9e307, 475405593de2b796224c6297aece44f321195919, f1471aa76d74e0df3b2a90731ca0208f498c670b, 68b41e68a62299f26cb16af422b5c7d1c69dafd9, db8f1dcf5950b91886b9df4270bc816370d292c1, d1d53aa30ab3b5ae89161c9cc840b3f7489ad386, 5.10.261, 4.20, 5.5, 5.14 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE. The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization. Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].
Quoted source text, attributed separately from HOL analysis.