CVE-2026-72112

In the Linux kernel, the following vulnerability has been resolved:

io_uring/bpf-ops: reject re-registration of an already-bound ops

io_install_bpf() only rejects a second registration on the ctx side

(ctx->bpf_ops) and sets the per-map back-pointer ops->priv

unconditionally. The struct_ops link path never advances a map past

BPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be

registered more than once, and bpf_io_reg() re-resolves the target ring

via fget(ops->ring_fd) on every call. A caller can therefore point the

same ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE

calls.

The second registration passes the ctx->bpf_ops check (the new ctx has

none) and overwrites ops->priv, orphaning the first ctx. Teardown

(io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops->priv, so

the orphaned ctx is never torn down: its ctx->loop_step keeps pointing

into the struct_ops trampoline, which is freed once the map is gone. A

later io_uring_enter() on the orphaned ring then calls the dangling

ctx->loop_step from io_run_loop() -- a use-after-free of freed

executable memory, reachable by a task with CAP_BPF + CAP_PERFMON.

Reject registration when ops->priv is already set, as hid_bpf_reg()

does for its struct_ops.