Cyber ·
CVE-2026-72711: Lean 4 kernel soundness flaw allows proving False
Advisory from the oss-sec feed describes a Lean 4 kernel flaw that allows building a verified proof of False, including 0 = 1, without declared axioms or modified files.
According to the text published by Jonathan Brossard on October 25, 2026 on the oss-sec feed, a soundness flaw in the Lean 4 kernel allows building a verified proof of False and, by extension, of any proposition, including 0 = 1. The proof uses no axioms, sorry, unsafeCast, debug.skipKernelTC or modified .olean files, and passes the kernel at maximum verification (--trust=0). As reported, the kernel add_opaque path skips the closure check check_no_metavar_no_fvar that exists in the definition and theorem paths. The text also mentions a stale cache, whose full detail is in the original advisory.
Relevance: proof assistants such as Lean underpin formal verification of software and mathematics. If the kernel accepts false propositions, the guarantee that verification provides no longer holds until the fix. Rota Nacional does not fix the Lean 4 kernel or verify proofs. If you study the advisory with AI, treat the material as public and do not paste code, proofs or internal data containing personal identifiers, credentials or secrets. To check the case, consult the original advisory and the CVE record, and verify with the Lean project whether an official fix has been published.