CVE-2026-72080 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing Linux-based systems should be aware of this vulnerability and take necessary actions to mitigate it. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Affected product deployments in managed environments should be identified and assigned an owner for follow-up. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. Asset inventory and security teams should also be informed to ensure proper vulnerability management and incident response planning are in place to address potential impacts on the organization. This includes confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. The vulnerability management process should be updated to include checks for this specific CVE and ensure that security teams are aware of the potential risks and mitigation strategies. Compensating controls should be reviewed and implemented where necessary to minimize the impact of the vulnerability until a patch or mitigation is applied. Monitoring and detection capabilities should be enhanced to identify potential exploitation attempts or anomalous behavior related to the vulnerability. By taking these steps, Linux kernel developers and administrators can effectively manage the risks associated with this vulnerability and protect their systems from potential attacks. Furthermore, they should consider implementing additional security measures such as tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented to ensure that the vulnerability is properly addressed and that the risk is mitigated. This proactive approach will help prevent potential security

Technical summary

The Linux kernel's fs/resctrl is vulnerable to a use-after-free attack during unmount or failure teardown. The default resource group's monitoring data is accessible via a kernfs file, and a concurrent reader may access already-freed monitoring event file private data. The vulnerability arises from the failure to set the RDT_DELETED flag for the default resource group. A concurrent reader may, after dropping kernfs active protection, block on rdtgroup_mutex while unmount proceeds to free the file private data and destroy the kernfs node without waiting for the reader. When the mutex is released, the reader wakes up, observes that RDT_DELETED is not set for the default group, and dereferences the already-freed file private data.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to set RDT_DELETED for the default group unconditionally.
• Do not allow a new resctrl mount if there are any waiters on the default group of the previous mount.
• Monitor for concurrent readers of event files associated with the default resource group.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability is caused by the failure to set the RDT_DELETED flag for the default resource group. A concurrent reader may access already-freed monitoring event file private data, leading to a use-after-free vulnerability.

Official resources