Rocq: Soundness vulnerability in guard checker (CVE-2026-72704)

A soundness flaw in the Rocq (formerly Coq) kernel guard checker allows the construction of a checked proof of False. The issue occurs because the guard checker fails to re-examine the recursive tree for an inductive type parameter after a transport (rewrite) operation modifies that parameter. By applying a rewrite along a type equality to a recursive argument, an attacker can bypass the termination checker, enabling the derivation of arbitrary propositions, including 0 = 1.

Impact

The vulnerability invalidates the logical consistency of proofs generated by the Rocq kernel. This allows users to construct proofs that are technically accepted by the kernel but mathematically unsound, which may impact the verification integrity of software, compilers, or cryptographic primitives relying on the Rocq proof assistant.

Recommendation

• Inventory environments utilizing the Rocq (formerly Coq) proof assistant to verify mathematical proofs or extract verified code.
• Monitor official Rocq development channels for patch releases addressing this guard checker deficiency.
• Review critical proofs generated or re-checked by the affected version to ensure they do not rely on rewritten recursive arguments that might have bypassed guard checking.