CVE-2026-72071: tracing/user_events: Fix use-after-free in user_event_mm_dup()
In the Linux kernel, the following vulnerability has been resolved:
tracing/userevents: Fix use-after-free in usereventmmdup()
usereventmmdup() walks the parent mm's enabler list locklessly under rcureadlock() during fork() (from copyprocess()); it does not take eventmutex:
rcureadlock(); listforeachentryrcu(enabler, &oldmm->enablers, mmenablerslink) enabler->event = usereventget(orig->event);
usereventenablerdestroy() removes an enabler from that list with listdelrcu() and then, without waiting for a grace period, drops the enabler's userevent reference with usereventput() and frees the enabler with kfree(). A reader that loaded the enabler before the listdelrcu() can still be walking it, which leads to two use-after-frees:
- kfree(enabler) frees the enabler while that reader dereferences enabler->event.
- usereventput() may drop the last reference to the userevent, which is then freed (via delayeddestroyuserevent() on a work queue), while the same reader does usereventget(orig->event) on it.
Both are reachable by an unprivileged task that can open usereventsdata: one multithreaded process that registers an enabler and then concurrently unregisters it and calls fork() triggers the race. KASAN reports a slab-use-after-free in usereventmmdup() during clone(), with a "refcountt: addition on 0" warning when the userevent is freed.
The enabler use-after-free was found first; the userevent one was reported by XIAO WU, and the earlier enabler-only fix did not address it.
Defer both the usereventput() and the kfree(enabler) to a work item queued with queuercuwork(), so they run only after an RCU grace period, once all readers walking the enabler list have finished. The put must run in process context because usereventput() takes eventmutex on the last reference, so a work queue is used rather than callrcu(). The now-unlocked put lets the locked argument of usereventenablerdestroy() be removed; all callers are updated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Defer both user_event_put() and kfree(enabler) to a work item queued with queue_rcu_work(), so they execute after an RCU grace period; use a work queue rather than call_rcu() because user_event_put() may take event_mutex in process context.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72071?
CVE-2026-72071 has a risk score of 65, indicating a medium severity vulnerability.
How do I fix CVE-2026-72071?
To address CVE-2026-72071, you should update your Linux kernel to the latest version that includes the fix for the use-after-free issue.
What systems are affected by CVE-2026-72071?
CVE-2026-72071 affects various versions of the Linux kernel that utilize the tracing/user_events functionality.
What type of vulnerability is CVE-2026-72071?
CVE-2026-72071 is classified as a Use After Free vulnerability, which can lead to potential memory corruption.
When was CVE-2026-72071 published?
CVE-2026-72071 was published on August 15, 2026.