CVE-2026-72071 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability and take steps to apply the necessary updates and mitigations. Affected operators, platforms, vulnerability-management, and security teams should review and act on this advisory to ensure the security of their systems.

Technical summary

The Linux kernel vulnerability (CVE-2026-72071) is related to a use-after-free issue in user_event_mm_dup(). The issue arises from the fact that user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork(), without taking event_mutex. This can lead to two use-after-frees: one where kfree(enabler) frees the enabler while a reader still dereferences enabler->event, and another where user_event_put() drops the last reference to the user_event, which is then freed while the reader does user_event_get(orig->event) on it.

Defensive priority

Apply Linux kernel updates to address use-after-free vulnerability in user_event_mm_dup().

Recommended defensive actions

• Apply Linux kernel updates to address the vulnerability
• Review and update Linux kernel configurations to prevent similar issues
• Monitor Linux kernel logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The Linux kernel vulnerability (CVE-2026-72071) is related to a use-after-free issue in user_event_mm_dup(). Evidence from official CVE and NVD sources indicates that the vulnerability was resolved by deferring user_event_put() and kfree(enabler) to a work item queued with queue_rcu_work(). Limited evidence suggests that an unprivileged task can trigger the race by opening user_events_data in a multithreaded process that registers an enabler, then concurrently unregisters it and calls fork().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.