CVE-2026-72071

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Fix use-after-free in user_event_mm_dup()

user_event_mm_dup() walks the parent mm's enabler list locklessly under

rcu_read_lock() during fork() (from copy_process()); it does not take

event_mutex:

rcu_read_lock();

list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link)

enabler->event = user_event_get(orig->event);

user_event_enabler_destroy() removes an enabler from that list with

list_del_rcu() and then, without waiting for a grace period, drops the

enabler's user_event reference with user_event_put() and frees the enabler

with kfree(). A reader that loaded the enabler before the list_del_rcu()

can still be walking it, which leads to two use-after-frees:

- kfree(enabler) frees the enabler while that reader dereferences

enabler->event.

- user_event_put() may drop the last reference to the user_event, which

is then freed (via delayed_destroy_user_event() on a work que

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References