Cyber ·
CVE-2026-72704: soundness flaw in the Rocq guard checker lets a proof of False pass
Security advisory on the Rocq kernel guard checker: after an inductive type parameter is rewritten, the recursive tree is not rechecked, and a proof of False may be accepted as valid.
Advisory CVE-2026-72704 describes a soundness flaw in the guard checker of the Rocq kernel, the proof assistant used for formal mathematics and software verification. According to the text, when a transport rewrite (eq_rect or rew) changes an inductive type parameter, the checker does not recheck the recursive tree of that parameter. A fixed point can then apply a rewrite based on a type equality to its recursive argument, which would allow building a verified proof of False and, by extension, of any proposition, including 0 = 1. The advisory was posted to the oss-sec list on 25 October 2026 and is treated as a zero-day, meaning no fix was known at disclosure. This is a summary of a machine-translated disclosure text; affected versions and fixes should be checked in the original source. For an organization, the relevance is indirect: anyone relying on formal proofs in Rocq should treat verified results as possibly unreliable until an official fix is published. Rota Nacional does not solve this kernel engineering problem and does not offer proof checking.