CVE-2026-72385 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining Linux-based systems, as well as security teams and vulnerability management teams, should be aware of this vulnerability and take necessary actions to prevent exploitation. Affected operators and platforms should review the official advisory and CVE record to validate affected systems and plan for updates or mitigations. Security teams should monitor system logs for potential exploitation attempts and review compensating controls for exposed systems.

Technical summary

The fprobe_fgraph_entry function in the Linux kernel has a NULL pointer dereference vulnerability. This occurs when a fprobe is registered on an already-live IP, causing the fill walk to process an exit_handler that the sizing walk did not count. The vulnerability can be triggered by a specific sequence of events, including function_graph_enter_regs, ftrace_graph_func, and __kernel_text_address. The vulnerability has been resolved in the Linux kernel.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to fix the vulnerability
• Review and update Linux kernel configurations to prevent similar issues
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was resolved in the Linux kernel. The NVD entry is currently Received. Further verification and analysis are required to confirm the affected scope and severity. Linux kernel developers and administrators should review the official advisory and CVE record to validate affected systems and plan for updates or mitigations. Evidence limits suggest that additional information may be available but has not been confirmed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.