CVE-2026-72427

CVE-2026-72427 is an algorithmic correctness bug in the BPF cgroup attachment code where a semantic invariant—specifically, that linear hlist position equals array index—silently diverged from the actual data structure layout policy. The root cause is BPF_F_PREORDER, a flag that changed program placement in the effective array without updating all consumer functions that assumed the old linear ordering held. The bug produces two distinct failure modes from the same faulty indexing logic. In replace_effective_prog(), the wrong program gets silently overwritten while the correct one becomes orphaned—the kernel continues running, but security policy enforcement executes out of intended order. In purge_effective_progs(), the bug creates a genuine use-after-free: the wrong array slot gets nulled, the target program pointer remains intact, bpf_prog_put() decrements the refcount to zero, and the freed object leaves a dangling pointer in the array. Whether this is exploitable depends on allocation timing and whether subsequent array access occurs before reallocation. The fix replays compute_effective_progs() placement logic rather than storing an inverse mapping—this choice is telling. It acknowledges that function as the authoritative source of truth, revealing the original bug was not merely an off-by-one but a fundamental misunderstanding of how BPF_F_PREORDER changed the semantic contract. The addition of effective_prog_pos() as a shared helper is the correct immediate fix, but it quarantines the problem rather than eliminating the underlying pattern. The more dangerous failure path is the silent corruption in replace_effective_prog(). Unlike the UAF, which crashes and generates detectable evidence, ordering corruption in BPF cgroup programs (which enforce network filtering, resource limits, and seccomp) propagates silently through every subsequent hook invocation. An attacker who triggers bpf_link_update() during a window with preorder programs has a reliable path to subvert enforcement semantics without touching the UAF path at all. Audit other BPF cgroup functions for similar linear position-to-index assumptions—this pattern of implicit ordering equivalence is exactly the kind of assumption that lives in 'obviously correct' iteration code and is hard to discover without explicit review.