UBUNTU-CVE-2026-89750: Use After Free

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct() copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup() should replace it, but it leaves that copied pointer unmodified if usereventmmalloc() fails. When the child exits, usereventmmremove() decrements a reference the child never owned, which ultimately frees usereventmm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as: BUG: KASAN: slab-use-after-free in currentusereventmm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44 Call Trace: <TASK> kasanreport+0xce/0x100 kasancheckrange+0x10f/0x1e0 currentusereventmm+0x51/0x1d0 usereventsioctl+0x82e/0x15c0 x64sysioctl+0x139/0x1c0 dosyscall64+0xce/0x450 entrySYSCALL64afterhwframe+0x77/0x7f Allocated by task 44: kasankmalloc+0x8f/0xa0 kmalloccachenoprof+0x180/0x3a0 usereventmmalloc+0x3c/0x1f0 currentusereventmm+0x88/0x1d0 Freed by task 42: kasanslabfree+0x43/0x70 kfree+0x13a/0x390 processonework+0x696/0xf90 workerthread+0x420/0xba0 The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.