tracing/user_events: Fix use-after-free in user_event_mm_dup()

Description

In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Fix use-after-free in user_event_mm_dup() user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork() (from copy_process()); it does not take event_mutex: rcu_read_lock(); list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link) enabler->event = user_event_get(orig->event); user_event_enabler_destroy() removes an enabler from that list with list_del_rcu() and then, without waiting for a grace period, drops the enabler's user_event reference with user_event_put() and frees the enabler with kfree(). A reader that loaded the enabler before the list_del_rcu() can still be walking it, which leads to two use-after-frees: - kfree(enabler) frees the enabler while that reader dereferences enabler->event. - user_event_put() may drop the last reference to the user_event, which is then freed (via delayed_destroy_user_event() on a work queue), while the same reader does user_event_get(orig->event) on it. Both are reachable by an unprivileged task that can open user_events_data: one multithreaded process that registers an enabler and then concurrently unregisters it and calls fork() triggers the race. KASAN reports a slab-use-after-free in user_event_mm_dup() during clone(), with a "refcount_t: addition on 0" warning when the user_event is freed. The enabler use-after-free was found first; the user_event one was reported by XIAO WU, and the earlier enabler-only fix did not address it. Defer both the user_event_put() and the kfree(enabler) to a work item queued with queue_rcu_work(), so they run only after an RCU grace period, once all readers walking the enabler list have finished. The put must run in process context because user_event_put() takes event_mutex on the last reference, so a work queue is used rather than call_rcu(). The now-unlocked put lets the locked argument of user_event_enabler_destroy() be removed; all callers are updated.

Timeline

Scores

EPSS (exploitation in 30 days)

0.17% · top 94% of all CVEs (11 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

• Linux · Linux

  • affected 7235759084a4f8524a46bd2638885ff3b34ce279 – < 25acb6711da6fa0382744fa92bd6d42a22c1ae68
  • affected 7235759084a4f8524a46bd2638885ff3b34ce279 – < 95400e7039cdfeb0b53652d521d766f1698cae95
  • affected 7235759084a4f8524a46bd2638885ff3b34ce279 – < b33ac2d39953efb12f598c0dae242c5f644ea669
  • affected 7235759084a4f8524a46bd2638885ff3b34ce279 – < 05b24f68f78ff3a1ef7f015f7327b35886b741f6
  • affected 7235759084a4f8524a46bd2638885ff3b34ce279 – < 50fd6dd755c6e48a38af2fa4621167eea56829c2

• Linux · Linux

  • affected 6.4
  • unaffected < 6.4
  • unaffected 6.6.148 – ≤ 6.6.*
  • unaffected 6.12.97 – ≤ 6.12.*
  • unaffected 6.18.40 – ≤ 6.18.*
  • unaffected 7.1.5 – ≤ 7.1.*
  • unaffected 7.2 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-59029 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-72071](https://cveledger.app/badge/CVE-2026-72071.svg)](https://cveledger.app/cve/CVE-2026-72071)

Record last updated 17 Aug 2026, 05:40 UTC.