UBUNTU-CVE-2026-72431: Use After Free
In the Linux kernel, the following vulnerability has been resolved: alloctag: fix use-after-free in /proc/allocinfo after module unload allocinfostart() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfostop() drops modlock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references: CPU0 (read) CPU1 (rmmod) ---- ---- allocinfostart(pos=0) downread(modlock) allocinfoshow() ... allocinfostop() upread(modlock) codetagunloadmodule() kfree(cmod) releasemoduletags() ... freemodmem() allocinfostart(pos=N) downread(modlock) // reuses cached iter, skips re-init allocinfoshow() ct->filename <-- UAF After freemodmem() frees the module's .rodata, allocinfoshow() dereferences ct->filename, ct->function which point there. Save the iterator state in allocinfonext() and resume from it in allocinfostart() with codetagnextct(), which detects module removal via idrfind() returning NULL and skips to the next module.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Update allocinfo iterator handling so allocinfo_next() saves the iterator state and allocinfo_start() resumes from it with codetag_next_ct(), which detects unloaded modules via idr_find() returning NULL and skips to the next module.
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A reader must access /proc/allocinfo across multiple read batches while a kernel module is unloaded between those batches. The vulnerable path occurs when a later read reuses cached iterator state that references memory freed during module unload.
Are systems affected if no modules are unloaded while /proc/allocinfo is being read?
The described race requires module unload to occur after allocinfo_stop() releases mod_lock and before a subsequent read resumes the cached iterator. Without that concurrent sequence, the reported use-after-free condition is not triggered.
Which Ubuntu kernel packages are identified as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What can be done if an update cannot be applied immediately?
Avoid reading /proc/allocinfo across multiple read operations while modules may be unloaded. Preventing or coordinating module unload during such access removes the race described in the vulnerability.