CVE-2026-72357 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and organizations using Linux systems should be aware of this vulnerability and take steps to apply the patch or implement compensating controls. The vulnerability has a high impact on Linux systems and requires immediate attention from Linux kernel maintainers, Linux distribution vendors, and organizations using Linux systems. Linux kernel maintainers should review and apply the official patch. Linux distribution vendors should update their Linux distributions with the patched kernel. Organizations using Linux systems should inventory their systems for exposure, apply compensating controls if patching is not feasible, and monitor for suspicious activity related to uprobes/x86 functionality.

Technical summary

The Linux kernel vulnerability CVE-2026-72357 exists in the uprobes/x86 subsystem, specifically in the __in_uprobe_trampoline function. The issue arises from using the wrong mm_struct in the unregister path, leading to incorrect VMA lookup. The fix involves adding a mm_struct pointer argument to __in_uprobe_trampoline and updating related callers to pass the correct mm_struct pointer. This change ensures that the proper memory management structure is used, preventing potential security issues. The vulnerability affects Linux kernel maintainers, Linux distribution vendors, and organizations using Linux systems.

Defensive priority

Linux kernel vulnerability in uprobes/x86, use proper mm_struct in __in_uprobe_trampoline, requires patching.

Recommended defensive actions

• Apply the official patch to update the __in_uprobe_trampoline function with the correct mm_struct pointer argument.
• Verify and update related callers to pass the proper mm_struct pointer.
• Inventory Linux systems for exposure and apply compensating controls if patching is not feasible.
• Monitor for suspicious activity related to uprobes/x86 functionality.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Linux kernel vulnerability CVE-2026-72357 exists in uprobes/x86, specifically in the __in_uprobe_trampoline function. The issue involves using the wrong mm_struct in the unregister path, which can lead to incorrect VMA lookup. A fix has been applied by adding a mm_struct pointer argument to __in_uprobe_trampoline and updating related callers to pass the proper mm_struct pointer.

Official resources