CVE-2026-72357 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
In the unregister path we use __in_uprobe_trampoline check with current->mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process.
Add mm_struct pointer argument to __in_uprobe_trampoline and changing related callers to pass proper mm_struct pointer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability addressed in this Linux kernel update relates to a critical flaw in the uprobes subsystem on x86 architectures that could potentially lead to privilege escalation or system instability. This issue specifically affects how the kernel handles memory management structures during the unregister process of uprobe operations, creating a fundamental mismatch between the execution context and the memory space being accessed.
The technical root cause lies in the improper use of memory management structures within the __in_uprobe_trampoline function. When the kernel attempts to unregister uprobe handlers, it incorrectly relies on current->mm for virtual memory area lookups during the tracer context execution rather than using the appropriate memory management structure associated with the traced process. This fundamental error occurs because the function operates in a different execution context than where the memory structures are valid.
The operational impact of this vulnerability extends beyond simple memory access violations, potentially enabling attackers to manipulate memory mappings in ways that could compromise system integrity and security boundaries. According to CWE-284, this represents an improper access control scenario where the kernel fails to properly validate memory management contexts during critical operations. The flaw creates a condition where memory structures from one process context can be incorrectly accessed or modified by another context, violating fundamental memory protection mechanisms.
This vulnerability directly relates to the ATT&CK technique T1068 which involves privilege escalation through improper access control and memory management flaws. The incorrect mm_struct usage could allow malicious processes to potentially bypass memory protection boundaries or manipulate kernel data structures that should remain isolated between different execution contexts.
The fix implemented addresses this by introducing a proper mm_struct pointer argument to the __in_uprobe_trampoline function and updating all related callers to pass the correct memory management structure. This ensures that when checking VMA lookups during uprobe unregister operations, the system uses the appropriate memory context associated with the traced process rather than the tracer's current execution context.
The mitigation strategy involves updating to a patched kernel version where this memory management context issue has been resolved. System administrators should prioritize applying these updates across all affected systems, particularly those running environments where uprobe functionality is actively used for debugging or monitoring purposes. Organizations implementing security monitoring should also verify that their detection systems can identify potential exploitation attempts targeting memory management vulnerabilities in kernel subsystems.
This vulnerability demonstrates the complexity of kernel-level programming where context switching between different execution models requires careful attention to memory management structures and proper validation of execution contexts. The fix represents a fundamental correction to ensure proper memory isolation and access control within the Linux kernel's uprobe infrastructure, maintaining the integrity of process boundaries during debugging operations.