CVE-2026-89988: kprobes: Protect kprobe_blacklist with RCU
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Protect kprobeblacklist with RCU
withinkprobeblacklist() traverses kprobeblacklist without holding kprobemutex. When a module is unloaded, kproberemoveareablacklist() removes blacklist entries and immediately frees them with kfree(). A concurrent call to withinkprobeblacklist() can therefore dereference freed memory.
Furthermore, withinkprobeblacklist() can be called in atomic or non-preemptible contexts where the sleeping kprobemutex cannot be taken.
Protect kprobeblacklist with RCU. Use guard(rcu)() and listforeachentryrcu() for traversal, listaddtailrcu() for insertions, listdelrcu() for deletions, and kfreercu() to reclaim entries safely after a grace period.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A module unload must remove kprobe blacklist entries while another execution concurrently calls within_kprobe_blacklist(). The concurrent traversal can then access an entry that was freed immediately after removal.
Why is locking with kprobe_mutex not a viable protection for this path?
within_kprobe_blacklist() may run in atomic or non-preemptible contexts. Because kprobe_mutex can sleep, it cannot safely be acquired in those contexts.
What does the resolved implementation change to prevent the race?
Blacklist traversal and updates are protected with RCU, including RCU list operations and deferred freeing with kfree_rcu(). This keeps removed entries valid until an RCU grace period has elapsed, preventing concurrent readers from dereferencing freed memory.