CVE-2026-64075

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Fix unregister_fprobe() to wait for RCU grace period

Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer")

changed fprobe to register struct fprobe to an rcu-hlist, but it forgot

to wait for RCU GP. Thus there can be use-after-free if the fprobe is

released right after unregistering. This can be happened on fprobe

event and sample module code.

To fix this issue, add synchronize_rcu() in unregister_fprobe().

Note that BPF is OK because fprobe is used as a part of

bpf_kprobe_multi_link. This unregisters its fprobe in

bpf_kprobe_multi_link_release() and it is deallocated via

bpf_kprobe_multi_link_dealloc(), which is invoked from

bpf_link_defer_dealloc_rcu_gp() RCU callback.

For BPF, this also introduced unregister_fprobe_async() which does

NOT wait for RCU grace priod.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References