CVE-2026-72012 (GCVE-0-2026-72012)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-08-23 12:46
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronize_rcu() when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to.
Impacted products
Vendor Product Version
Linux Linux Version: a6ed2aee54644cfa2d04ca86308767f5c3a087e8
Version: a6ed2aee54644cfa2d04ca86308767f5c3a087e8
Version: a6ed2aee54644cfa2d04ca86308767f5c3a087e8
Version: a6ed2aee54644cfa2d04ca86308767f5c3a087e8
Version: a6ed2aee54644cfa2d04ca86308767f5c3a087e8
Version: a6ed2aee54644cfa2d04ca86308767f5c3a087e8
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "428cedade9b2cc8e48f00742df0cfd770e77a803",
              "status": "affected",
              "version": "a6ed2aee54644cfa2d04ca86308767f5c3a087e8",
              "versionType": "git"
            },
            {
              "lessThan": "3c693635bb7b3a9b6645831a84fed2af46cdf249",
              "status": "affected",
              "version": "a6ed2aee54644cfa2d04ca86308767f5c3a087e8",
              "versionType": "git"
            },
            {
              "lessThan": "38366140dc8ee3568c7f0191d517e117963bd580",
              "status": "affected",
              "version": "a6ed2aee54644cfa2d04ca86308767f5c3a087e8",
              "versionType": "git"
            },
            {
              "lessThan": "fad36954b29592ce463254179c3043697678481f",
              "status": "affected",
              "version": "a6ed2aee54644cfa2d04ca86308767f5c3a087e8",
              "versionType": "git"
            },
            {
              "lessThan": "dd0160a0842337f12e7694d68b184050afc6d3a4",
              "status": "affected",
              "version": "a6ed2aee54644cfa2d04ca86308767f5c3a087e8",
              "versionType": "git"
            },
            {
              "lessThan": "fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a",
              "status": "affected",
              "version": "a6ed2aee54644cfa2d04ca86308767f5c3a087e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Call synchronize_rcu() when unregistering\n\nThis ensures that any RCU readers traversing the instance list\nhave finished, before releasing the reference on the tracer that\nthe instance points to."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires writing tracefs (e.g. enabling osnoise/timerlat via current_tracer and deleting a tracing instance); there is no network, adjacent, or physical entry path to osnoise_unregister_instance().\nAC:L - An attacker who can configure tracing controls both teardown and sampling; deleting a trace instance while osnoise/timerlat is active races RCU readers that still dereference inst-\u003etr, and this race is reliably attacker-driven.\nPR:L - Triggering requires tracefs write access to configure/destroy tracing instances; this is not init-namespace root on every system (tracing group/remounted tracefs or CAP_SYS_ADMIN in a container with tracefs mounted suffices).\nUI:N - No victim interaction is required; exploitation is achieved entirely by the attacker\u0027s tracing configuration and concurrent instance teardown.\nS:U - The use-after-free corrupts kernel memory within the same kernel security domain; it does not cross VM, IOMMU, or sandbox boundaries by itself.\nC:H - Deferred kvfree_rcu_mightsleep() lets __remove_instance() free the trace_array while RCU readers in IRQ/NMI/timerlat paths still dereference inst-\u003etr, a classic UAF enabling arbitrary kernel memory disclosure.\nI:H - The dangling trace_array pointer can be leveraged for heap corruption and control-flow hijack; UAF of kernel heap objects is scored as high integrity impact even when the immediate failure mode is a crash.\nA:H - Concurrent access to a freed trace_array causes kernel oops/panic from RCU list walkers and buffer operations; UAF in interrupt context can crash or hang the system even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:24.402Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/428cedade9b2cc8e48f00742df0cfd770e77a803"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c693635bb7b3a9b6645831a84fed2af46cdf249"
        },
        {
          "url": "https://git.kernel.org/stable/c/38366140dc8ee3568c7f0191d517e117963bd580"
        },
        {
          "url": "https://git.kernel.org/stable/c/fad36954b29592ce463254179c3043697678481f"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd0160a0842337f12e7694d68b184050afc6d3a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe58f457ad8d0a2bef4e053cfecca4b5cd266b1a"
        }
      ],
      "title": "tracing/osnoise: Call synchronize_rcu() when unregistering",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72012",
    "datePublished": "2026-08-15T05:51:41.222Z",
    "dateReserved": "2026-08-09T03:40:39.899Z",
    "dateUpdated": "2026-08-23T12:46:24.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…