CVE-2026-72071 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing/user_events: Fix use-after-free in user_event_mm_dup()
user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork() (from copy_process()); it does not take event_mutex:
rcu_read_lock(); list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link) enabler->event = user_event_get(orig->event);
user_event_enabler_destroy() removes an enabler from that list with list_del_rcu() and then, without waiting for a grace period, drops the enabler's user_event reference with user_event_put() and frees the enabler with kfree(). A reader that loaded the enabler before the list_del_rcu() can still be walking it, which leads to two use-after-frees:
- kfree(enabler) frees the enabler while that reader dereferences enabler->event.
- user_event_put() may drop the last reference to the user_event, which is then freed (via delayed_destroy_user_event() on a work queue), while the same reader does user_event_get(orig->event) on it.
Both are reachable by an unprivileged task that can open user_events_data: one multithreaded process that registers an enabler and then concurrently unregisters it and calls fork() triggers the race. KASAN reports a slab-use-after-free in user_event_mm_dup() during clone(), with a "refcount_t: addition on 0" warning when the user_event is freed.
The enabler use-after-free was found first; the user_event one was reported by XIAO WU, and the earlier enabler-only fix did not address it.
Defer both the user_event_put() and the kfree(enabler) to a work item queued with queue_rcu_work(), so they run only after an RCU grace period, once all readers walking the enabler list have finished. The put must run in process context because user_event_put() takes event_mutex on the last reference, so a work queue is used rather than call_rcu(). The now-unlocked put lets the locked argument of user_event_enabler_destroy() be removed; all callers are updated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The Linux kernel vulnerability identified in the tracing/user_events subsystem involves a critical use-after-free condition within the user_event_mm_dup function, which is invoked during process creation via copy_process. This flaw arises from an improper synchronization mechanism when handling the enabler list associated with memory management structures. Specifically, user_event_mm_dup iterates over the parent process's enabler list using RCU read-side locking without acquiring the event_mutex lock. While this approach aims to minimize performance overhead by avoiding heavy mutex contention during fork operations, it creates a race condition window where concurrent modifications to the same data structure can lead to memory corruption and potential privilege escalation or denial of service scenarios.
The technical root cause lies in the asynchronous destruction logic within user_event_enabler_destroy. When an enabler is removed from the list using list_del_rcu, the function immediately proceeds to drop the reference count via user_event_put and subsequently frees the enabler structure with kfree without waiting for an RCU grace period. This premature deallocation means that any reader thread currently traversing the list under rcu_read_lock may still hold a pointer to the now-freed memory. If such a reader attempts to dereference the enabler object, specifically accessing the event field or calling user_event_get on it, it triggers a slab-use-after-free error. The vulnerability is particularly dangerous because it can be triggered by an unprivileged task capable of opening user_events_data, allowing local attackers to exploit this race condition during concurrent registration and unregistration followed by forking operations.
The operational impact of this vulnerability includes system instability due to kernel panics or oops reports generated by the Kernel Address Sanitizer (KASAN), which detects invalid memory accesses. Furthermore, the use-after-free can lead to arbitrary code execution if an attacker carefully crafts a scenario where freed memory is reallocated for malicious purposes before being dereferenced. The vulnerability encompasses two distinct but related issues: the direct freeing of the enabler structure while it is still in use, and the premature release of the underlying user_event object via delayed_destroy_user_event on a work queue. Both scenarios result in undefined behavior that compromises kernel integrity and security boundaries.
To mitigate this risk, the fix defers both the decrementing of reference counts through user_event_put and the actual memory deallocation via kfree to occur only after an RCU grace period has elapsed. This ensures that all existing readers have completed their traversal of the enabler list before any resources are reclaimed. The implementation utilizes queue_rcu_work to schedule these cleanup tasks, which is necessary because user_event_put requires process context and may acquire event_mutex on the last reference drop, a requirement not supported by standard call_rcu callbacks. By updating all callers to remove the locked argument from user_event_enabler_destroy, the patch ensures consistent behavior across the subsystem while maintaining proper synchronization semantics.
From an industry standards perspective, this vulnerability maps directly to CWE-416: Use After Free, as it involves accessing memory after it has been freed, leading to unpredictable outcomes and potential security breaches. In terms of attack vectors, it aligns with MITRE ATT&CK techniques related to privilege escalation through local exploitation of kernel vulnerabilities, specifically leveraging race conditions in system call handlers or process management functions. The fix exemplifies best practices for RCU usage by ensuring that destruction logic respects the grace period requirements, thereby preventing data races and memory safety violations in concurrent environments. Administrators should apply this patch immediately to systems running affected versions of the Linux kernel to prevent potential exploitation by local users seeking to escalate privileges or disrupt system availability through crafted process creation sequences.