CVE-2026-89750: tracing/user_events: Clear copied tracing state before fork duplication
In the Linux kernel, the following vulnerability has been resolved:
tracing/userevents: Clear copied tracing state before fork duplication
duptaskstruct() copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup() should replace it, but it leaves that copied pointer unmodified if usereventmmalloc() fails.
When the child exits, usereventmmremove() decrements a reference the child never owned, which ultimately frees usereventmm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as:
BUG: KASAN: slab-use-after-free in currentusereventmm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44
Call Trace: <TASK> kasanreport+0xce/0x100 kasancheckrange+0x10f/0x1e0 currentusereventmm+0x51/0x1d0 usereventsioctl+0x82e/0x15c0 x64sysioctl+0x139/0x1c0 dosyscall64+0xce/0x450 entrySYSCALL64afterhwframe+0x77/0x7f
Allocated by task 44: kasankmalloc+0x8f/0xa0 kmalloccachenoprof+0x180/0x3a0 usereventmmalloc+0x3c/0x1f0 currentusereventmm+0x88/0x1d0
Freed by task 42: kasanslabfree+0x43/0x70 kfree+0x13a/0x390 processonework+0x696/0xf90 workerthread+0x420/0xba0
The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Linux kernel tracing/user_events code so that during fork duplication the copied tracing state/pointer is cleared before any possible failure; this prevents slab use-after-free when user_event_mm is later decremented/freed on child exit.
Linux kernel tracing/user_events Clear copied tracing state before fork/duplication = Apply the fix to clear/cancel the copied pointer before any possible failure in user_event_mm_dup() (e.g., clear the copied tracing state before child duplication).
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A task must have user-event tracing state, then fork a child at a time when allocation of replacement user-event state for that child fails. The child subsequently exits and drops a reference it never acquired, potentially leaving the parent with a stale pointer.
Is this limited to systems using tracing user events?
The vulnerable state is user_event_mm, so the described failure path depends on user-event tracing state being present. The provided information does not establish exposure for systems that do not use this tracing functionality.
How can administrators identify a possible occurrence?
Affected systems may report a KASAN slab use-after-free involving current_user_event_mm and user_events_ioctl. The supplied trace identifies a write of size 4 and shows allocation through user_event_mm_alloc and freeing through user_event_mm_remove-related cleanup.
Which fixes are referenced?
The provided references list three stable kernel commits: 63b39e49a4c9d68e010e96b26fc7374f0864f2b1, 25a0758cf6bdbfddac2be71124c9bd0692f4b0b1, and b799f67119aff179719a0b1e12441ebbdaaf62f9.