CVE-2026-72431
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: alloc_tag: fix use-after-free in /proc/allocinfo after module unload allocinfo_start() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfo_stop() drops mod_lock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references: CPU0 (read) CPU1 (rmmod) ---- ---- allocinfo_start(pos=0) down_read(mod_lock) allocinfo_show() ... allocinfo_stop() up_read(mod_lock) codetag_unload_module() kfree(cmod) release_module_tags() ... free_mod_mem() allocinfo_start(pos=N) down_read(mod_lock) // reuses cached iter, skips re-init allocinfo_show() ct->filename <-- UAF After free_mod_mem() frees the module's .rodata, allocinfo_show() dereferences ct->filename, ct->function which point there. Save the iterator state in allocinfo_next() and resume from it in allocinfo_start() with codetag_next_ct(), which detects module removal via idr_find() returning NULL and skips to the next module.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72431
EUVD
EUVD-2026-59330

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's /proc/allocinfo interface. When a module is unloaded, its memory is freed while a cached iterator in /proc/allocinfo still references it. Subsequent reads after the first one reuse this stale iterator, leading to a use-after-free condition when dereferencing module data that no longer exists.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a use-after-free condition in /proc/allocinfo after module unload. Detection requires checking kernel logs for related errors or monitoring for crashes during module unloading. No direct commands are provided in the context, but kernel logs (dmesg) or system crash reports may indicate exploitation.

Impact Analysis

This vulnerability could allow local attackers to cause a denial of service or potentially execute arbitrary code with kernel privileges. It may crash the system or enable privilege escalation if exploited.

Mitigation Strategies

Apply the latest kernel patches or updates that resolve this issue. Avoid unloading kernel modules unnecessarily until the patch is applied. Monitor system stability and kernel logs for signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart