CVE-2026-72071 (GCVE-0-2026-72071)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:40
VLAI
Title
tracing/user_events: Fix use-after-free in user_event_mm_dup()
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Fix use-after-free in user_event_mm_dup() user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork() (from copy_process()); it does not take event_mutex: rcu_read_lock(); list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link) enabler->event = user_event_get(orig->event); user_event_enabler_destroy() removes an enabler from that list with list_del_rcu() and then, without waiting for a grace period, drops the enabler's user_event reference with user_event_put() and frees the enabler with kfree(). A reader that loaded the enabler before the list_del_rcu() can still be walking it, which leads to two use-after-frees: - kfree(enabler) frees the enabler while that reader dereferences enabler->event. - user_event_put() may drop the last reference to the user_event, which is then freed (via delayed_destroy_user_event() on a work queue), while the same reader does user_event_get(orig->event) on it. Both are reachable by an unprivileged task that can open user_events_data: one multithreaded process that registers an enabler and then concurrently unregisters it and calls fork() triggers the race. KASAN reports a slab-use-after-free in user_event_mm_dup() during clone(), with a "refcount_t: addition on 0" warning when the user_event is freed. The enabler use-after-free was found first; the user_event one was reported by XIAO WU, and the earlier enabler-only fix did not address it. Defer both the user_event_put() and the kfree(enabler) to a work item queued with queue_rcu_work(), so they run only after an RCU grace period, once all readers walking the enabler list have finished. The put must run in process context because user_event_put() takes event_mutex on the last reference, so a work queue is used rather than call_rcu(). The now-unlocked put lets the locked argument of user_event_enabler_destroy() be removed; all callers are updated.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 25acb6711da6fa0382744fa92bd6d42a22c1ae68 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 95400e7039cdfeb0b53652d521d766f1698cae95 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < b33ac2d39953efb12f598c0dae242c5f644ea669 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 05b24f68f78ff3a1ef7f015f7327b35886b741f6 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 50fd6dd755c6e48a38af2fa4621167eea56829c2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25acb6711da6fa0382744fa92bd6d42a22c1ae68",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "95400e7039cdfeb0b53652d521d766f1698cae95",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "b33ac2d39953efb12f598c0dae242c5f644ea669",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "05b24f68f78ff3a1ef7f015f7327b35886b741f6",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "50fd6dd755c6e48a38af2fa4621167eea56829c2",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Fix use-after-free in user_event_mm_dup()\n\nuser_event_mm_dup() walks the parent mm\u0027s enabler list locklessly under\nrcu_read_lock() during fork() (from copy_process()); it does not take\nevent_mutex:\n\n\trcu_read_lock();\n\tlist_for_each_entry_rcu(enabler, \u0026old_mm-\u003eenablers, mm_enablers_link)\n\t\tenabler-\u003eevent = user_event_get(orig-\u003eevent);\n\nuser_event_enabler_destroy() removes an enabler from that list with\nlist_del_rcu() and then, without waiting for a grace period, drops the\nenabler\u0027s user_event reference with user_event_put() and frees the enabler\nwith kfree(). A reader that loaded the enabler before the list_del_rcu()\ncan still be walking it, which leads to two use-after-frees:\n\n - kfree(enabler) frees the enabler while that reader dereferences\n   enabler-\u003eevent.\n\n - user_event_put() may drop the last reference to the user_event, which\n   is then freed (via delayed_destroy_user_event() on a work queue), while\n   the same reader does user_event_get(orig-\u003eevent) on it.\n\nBoth are reachable by an unprivileged task that can open user_events_data:\none multithreaded process that registers an enabler and then concurrently\nunregisters it and calls fork() triggers the race. KASAN reports a\nslab-use-after-free in user_event_mm_dup() during clone(), with a\n\"refcount_t: addition on 0\" warning when the user_event is freed.\n\nThe enabler use-after-free was found first; the user_event one was reported\nby XIAO WU, and the earlier enabler-only fix did not address it.\n\nDefer both the user_event_put() and the kfree(enabler) to a work item\nqueued with queue_rcu_work(), so they run only after an RCU grace period,\nonce all readers walking the enabler list have finished. The put must run\nin process context because user_event_put() takes event_mutex on the last\nreference, so a work queue is used rather than call_rcu(). The now-unlocked\nput lets the locked argument of user_event_enabler_destroy() be removed;\nall callers are updated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local syscalls (clone/fork via copy_process and ioctl on tracefs user_events_data); there is no network, adjacent-wireless, or physical-device path into user_event_mm_dup or user_event_enabler_destroy.\nAC:L - A single multithreaded attacker process can register an enabler, then concurrently issue DIAG_IOCSUNREG and fork/clone; the attacker controls both sides of the RCU race, and the fix commit reports reliable KASAN slab-use-after-free reproduction.\nPR:L - Non-persist DIAG_IOCSREG and DIAG_IOCSUNREG enforce no CAP_SYS_ADMIN or perfmon check; only write access to tracefs user_events_data is required, and tracing deployments (Android/Perfetto, ChromeOS, developer tracefs gid mounts) intentionally grant that to unprivileged local users.\nUI:N - The attacker performs registration, concurrent unregistration, and fork entirely within their own process; no victim action, mount, or cooperating user is required beyond running the exploit code.\nS:U - The coupled slab use-after-frees occur in kernel heap during local fork handling and do not cross a VM, IOMMU, or sandbox boundary; impact is standard in-kernel memory corruption on the same host.\nC:H - Fork-time RCU traversal dereferences freed enabler and user_event objects and calls user_event_get on a freed user_event (refcount addition on zero per KASAN), enabling attacker-influenced kernel memory reads via slab grooming.\nI:H - Premature kfree of enabler and user_event while fork duplicates enablement lets an attacker reclaim kmalloc slabs holding tracepoint and trace_event_call state, supporting heap spray and arbitrary kernel write or control-flow hijack primitives.\nA:H - KASAN reports slab-use-after-free in user_event_mm_dup during clone, and repeated concurrent unreg/fork reliably oopses or panics the kernel even before full exploitation, constituting dependable local denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:01.974Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25acb6711da6fa0382744fa92bd6d42a22c1ae68"
        },
        {
          "url": "https://git.kernel.org/stable/c/95400e7039cdfeb0b53652d521d766f1698cae95"
        },
        {
          "url": "https://git.kernel.org/stable/c/b33ac2d39953efb12f598c0dae242c5f644ea669"
        },
        {
          "url": "https://git.kernel.org/stable/c/05b24f68f78ff3a1ef7f015f7327b35886b741f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/50fd6dd755c6e48a38af2fa4621167eea56829c2"
        }
      ],
      "title": "tracing/user_events: Fix use-after-free in user_event_mm_dup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72071",
    "datePublished": "2026-08-15T05:52:23.215Z",
    "dateReserved": "2026-08-09T03:40:39.904Z",
    "dateUpdated": "2026-08-17T05:40:01.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72071",
      "date": "2026-09-21",
      "epss": "0.0017",
      "percentile": "0.06742"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/trace_events_user.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "25acb6711da6fa0382744fa92bd6d42a22c1ae68",
                    "status": "affected",
                    "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95400e7039cdfeb0b53652d521d766f1698cae95",
                    "status": "affected",
                    "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b33ac2d39953efb12f598c0dae242c5f644ea669",
                    "status": "affected",
                    "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05b24f68f78ff3a1ef7f015f7327b35886b741f6",
                    "status": "affected",
                    "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "50fd6dd755c6e48a38af2fa4621167eea56829c2",
                    "status": "affected",
                    "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/trace_events_user.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Fix use-after-free in user_event_mm_dup()\n\nuser_event_mm_dup() walks the parent mm\u0027s enabler list locklessly under\nrcu_read_lock() during fork() (from copy_process()); it does not take\nevent_mutex:\n\n\trcu_read_lock();\n\tlist_for_each_entry_rcu(enabler, \u0026old_mm-\u003eenablers, mm_enablers_link)\n\t\tenabler-\u003eevent = user_event_get(orig-\u003eevent);\n\nuser_event_enabler_destroy() removes an enabler from that list with\nlist_del_rcu() and then, without waiting for a grace period, drops the\nenabler\u0027s user_event reference with user_event_put() and frees the enabler\nwith kfree(). A reader that loaded the enabler before the list_del_rcu()\ncan still be walking it, which leads to two use-after-frees:\n\n - kfree(enabler) frees the enabler while that reader dereferences\n   enabler-\u003eevent.\n\n - user_event_put() may drop the last reference to the user_event, which\n   is then freed (via delayed_destroy_user_event() on a work queue), while\n   the same reader does user_event_get(orig-\u003eevent) on it.\n\nBoth are reachable by an unprivileged task that can open user_events_data:\none multithreaded process that registers an enabler and then concurrently\nunregisters it and calls fork() triggers the race. KASAN reports a\nslab-use-after-free in user_event_mm_dup() during clone(), with a\n\"refcount_t: addition on 0\" warning when the user_event is freed.\n\nThe enabler use-after-free was found first; the user_event one was reported\nby XIAO WU, and the earlier enabler-only fix did not address it.\n\nDefer both the user_event_put() and the kfree(enabler) to a work item\nqueued with queue_rcu_work(), so they run only after an RCU grace period,\nonce all readers walking the enabler list have finished. The put must run\nin process context because user_event_put() takes event_mutex on the last\nreference, so a work queue is used rather than call_rcu(). The now-unlocked\nput lets the locked argument of user_event_enabler_destroy() be removed;\nall callers are updated."
          }
        ],
        "id": "CVE-2026-72071",
        "lastModified": "2026-08-17T06:18:05.650",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:16.820",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/05b24f68f78ff3a1ef7f015f7327b35886b741f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25acb6711da6fa0382744fa92bd6d42a22c1ae68"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/50fd6dd755c6e48a38af2fa4621167eea56829c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95400e7039cdfeb0b53652d521d766f1698cae95"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b33ac2d39953efb12f598c0dae242c5f644ea669"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T10:32:54+00:00",
      "cve": "CVE-2026-72071",
      "id": "CVE-2026-72071",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing/user_events: Fix use-after-free in user_event_mm_dup()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72071.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:10:13Z",
      "cve": "CVE-2026-72071",
      "id": "CVE-2026-72071",
      "initial_release_date": "2026-08-28T01:01:29Z",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "285",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72071",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72071.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.