CVE-2026-72071 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability and take steps to apply the necessary updates and mitigations. Affected operators, platforms, vulnerability-management, and security teams should review and act on this advisory to ensure the security of their systems.

Technical summary

The Linux kernel vulnerability (CVE-2026-72071) is related to a use-after-free issue in user_event_mm_dup(). The issue arises from the fact that user_event_mm_dup() walks the parent mm's enabler list locklessly under rcu_read_lock() during fork(), without taking event_mutex. This can lead to two use-after-frees: one where kfree(enabler) frees the enabler while a reader still dereferences enabler->event, and another where user_event_put() drops the last reference to the user_event, which is then freed while the reader does user_event_get(orig->event) on it.

Defensive priority

Apply Linux kernel updates to address use-after-free vulnerability in user_event_mm_dup().

Recommended defensive actions

• Apply Linux kernel updates to address the vulnerability
• Review and update Linux kernel configurations to prevent similar issues
• Monitor Linux kernel logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The Linux kernel vulnerability (CVE-2026-72071) is related to a use-after-free issue in user_event_mm_dup(). Evidence from official CVE and NVD sources indicates that the vulnerability was resolved by deferring user_event_put() and kfree(enabler) to a work item queued with queue_rcu_work(). Limited evidence suggests that an unprivileged task can trigger the race by opening user_events_data in a multithreaded process that registers an enabler, then concurrently unregisters it and calls fork().

Official resources