CVE-2026-72071

Description

In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Fix use-after-free in user_event_mm_dup() user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork() (from copy_process()); it does not take event_mutex: rcu_read_lock(); list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link) enabler->event = user_event_get(orig->event); user_event_enabler_destroy() removes an enabler from that list with list_del_rcu() and then, without waiting for a grace period, drops the enabler's user_event reference with user_event_put() and frees the enabler with kfree(). A reader that loaded the enabler before the list_del_rcu() can still be walking it, which leads to two use-after-frees: - kfree(enabler) frees the enabler while that reader dereferences enabler->event. - user_event_put() may drop the last reference to the user_event, which is then freed (via delayed_destroy_user_event() on a work queue), while the same reader does user_event_get(orig->event) on it. Both are reachable by an unprivileged task that can open user_events_data: one multithreaded process that registers an enabler and then concurrently unregisters it and calls fork() triggers the race. KASAN reports a slab-use-after-free in user_event_mm_dup() during clone(), with a "refcount_t: addition on 0" warning when the user_event is freed. The enabler use-after-free was found first; the user_event one was reported by XIAO WU, and the earlier enabler-only fix did not address it. Defer both the user_event_put() and the kfree(enabler) to a work item queued with queue_rcu_work(), so they run only after an RCU grace period, once all readers walking the enabler list have finished. The put must run in process context because user_event_put() takes event_mutex on the last reference, so a work queue is used rather than call_rcu(). The now-unlocked put lets the locked argument of user_event_enabler_destroy() be removed; all callers are updated.

Gravité et risque d'exploitation

CVE-2026-72071 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.17 %, ce qui la place devant 6.0 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions 7.1.5, 6.18.40, <=6.12.*, 0, <=7.1.*, 6.4, 6.12.97, <=6.6.*, <50fd6dd755c6e48a38af2fa4621167eea56829c2, <6.4, <b33ac2d39953efb12f598c0dae242c5f644ea669, <=6.18.*, <25acb6711da6fa0382744fa92bd6d42a22c1ae68, <05b24f68f78ff3a1ef7f015f7327b35886b741f6, 7235759084a4f8524a46bd2638885ff3b34ce279, <95400e7039cdfeb0b53652d521d766f1698cae95, <=*, 6.6.148, 7.2) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/25acb6711da6fa0382744fa92bd6d42a22c1ae68
• https://git.kernel.org/stable/c/95400e7039cdfeb0b53652d521d766f1698cae95
• https://git.kernel.org/stable/c/b33ac2d39953efb12f598c0dae242c5f644ea669
• https://git.kernel.org/stable/c/05b24f68f78ff3a1ef7f015f7327b35886b741f6
• https://git.kernel.org/stable/c/50fd6dd755c6e48a38af2fa4621167eea56829c2