CVE-2026-72071: tracing/user_events: Fix use-after-free in user_event_mm_dup()

CVE-2026-72071: tracing/user_events: Fix use-after-free in user_event_mm_dup()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Fix use-after-free in user_event_mm_dup()

user_event_mm_dup() walks the parent mm's enabler list locklessly under
rcu_read_lock() during fork() (from copy_process()); it does not take
event_mutex:

	rcu_read_lock();
	list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link)
		enabler->event = user_event_get(orig->event);

user_event_enabler_destroy() removes an enabler from that list with
list_del_rcu() and then, without waiting for a grace period, drops the
enabler's user_event reference with user_event_put() and frees the enabler
with kfree(). A reader that loaded the enabler before the list_del_rcu()
can still be walking it, which leads to two use-after-frees:

 - kfree(enabler) frees the enabler while that reader dereferences
   enabler->event.

 - user_event_put() may drop the last reference to the user_event, which
   is then freed (via delayed_destroy_user_event() on a work queue), while
   the same reader does user_event_get(orig->event) on it.

Both are reachable by an unprivileged task that can open user_events_data:
one multithreaded process that registers an enabler and then concurrently
unregisters it and calls fork() triggers the race. KASAN reports a
slab-use-after-free in user_event_mm_dup() during clone(), with a
"refcount_t: addition on 0" warning when the user_event is freed.

The enabler use-after-free was found first; the user_event one was reported
by XIAO WU, and the earlier enabler-only fix did not address it.

Defer both the user_event_put() and the kfree(enabler) to a work item
queued with queue_rcu_work(), so they run only after an RCU grace period,
once all readers walking the enabler list have finished. The put must run
in process context because user_event_put() takes event_mutex on the last
reference, so a work queue is used rather than call_rcu(). The now-unlocked
put lets the locked argument of user_event_enabler_destroy() be removed;
all callers are updated.

The Linux kernel CVE team has assigned CVE-2026-72071 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit 7235759084a4f8524a46bd2638885ff3b34ce279 and fixed in 6.6.148 with commit 25acb6711da6fa0382744fa92bd6d42a22c1ae68
	Issue introduced in 6.4 with commit 7235759084a4f8524a46bd2638885ff3b34ce279 and fixed in 6.12.97 with commit 95400e7039cdfeb0b53652d521d766f1698cae95
	Issue introduced in 6.4 with commit 7235759084a4f8524a46bd2638885ff3b34ce279 and fixed in 6.18.40 with commit b33ac2d39953efb12f598c0dae242c5f644ea669
	Issue introduced in 6.4 with commit 7235759084a4f8524a46bd2638885ff3b34ce279 and fixed in 7.1.5 with commit 05b24f68f78ff3a1ef7f015f7327b35886b741f6
	Issue introduced in 6.4 with commit 7235759084a4f8524a46bd2638885ff3b34ce279 and fixed in 7.2-rc3 with commit 50fd6dd755c6e48a38af2fa4621167eea56829c2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72071
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/trace_events_user.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/25acb6711da6fa0382744fa92bd6d42a22c1ae68
	https://git.kernel.org/stable/c/95400e7039cdfeb0b53652d521d766f1698cae95
	https://git.kernel.org/stable/c/b33ac2d39953efb12f598c0dae242c5f644ea669
	https://git.kernel.org/stable/c/05b24f68f78ff3a1ef7f015f7327b35886b741f6
	https://git.kernel.org/stable/c/50fd6dd755c6e48a38af2fa4621167eea56829c2