CVE-2026-89750

Received Received - Intake

Use-After-Free in Linux Kernel tracing/user_events

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails. When the child exits, user_event_mm_remove() decrements a reference the child never owned, which ultimately frees user_event_mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as: BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44 Call Trace: <TASK> kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 current_user_event_mm+0x51/0x1d0 user_events_ioctl+0x82e/0x15c0 __x64_sys_ioctl+0x139/0x1c0 do_syscall_64+0xce/0x450 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 44: __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x180/0x3a0 user_event_mm_alloc+0x3c/0x1f0 current_user_event_mm+0x88/0x1d0 Freed by task 42: __kasan_slab_free+0x43/0x70 kfree+0x13a/0x390 process_one_work+0x696/0xf90 worker_thread+0x420/0xba0 The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89750

EUVD

EUVD-2026-76662

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's tracing subsystem. It occurs when a child process inherits a stale pointer to a tracing state from its parent during fork operations. If the child fails to allocate its own tracing state, it leaves the inherited pointer unmodified. When the child exits, it incorrectly frees the parent's tracing state, causing a use-after-free condition that can lead to crashes or potential code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing/user_events subsystem and requires kernel-level detection. It manifests as a use-after-free (UAF) condition in user_event_mm structures. Detection typically involves kernel logs showing KASAN reports or slab corruption errors. Check system logs for messages like 'BUG: KASAN: slab-use-after-free' or 'current_user_event_mm' traces.

Impact Analysis

This vulnerability could allow an attacker with local access to cause system instability, crashes, or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or privilege escalation on affected Linux systems.

Mitigation Strategies

Apply the kernel patch that clears the copied tracing state before fork duplication. Update to a Linux kernel version that includes the fix for CVE-2026-89750. If immediate patching is not possible, consider disabling the user_events subsystem if not required, though this may impact tracing functionality.

Hi! I’m here to help you understand CVE-2026-89750. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70