CVE-2026-72431 (GCVE-0-2026-72431)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-08-17 05:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
alloc_tag: fix use-after-free in /proc/allocinfo after module unload
allocinfo_start() only reinitializes the codetag iterator at position 0.
For subsequent reads (position > 0), it reuses cached iterator state from
the previous batch. allocinfo_stop() drops mod_lock between read batches,
which allows module unload to complete and free the module memory that the
cached iterator still references:
CPU0 (read) CPU1 (rmmod)
---- ----
allocinfo_start(pos=0)
down_read(mod_lock)
allocinfo_show()
...
allocinfo_stop()
up_read(mod_lock)
codetag_unload_module()
kfree(cmod)
release_module_tags()
...
free_mod_mem()
allocinfo_start(pos=N)
down_read(mod_lock)
// reuses cached iter, skips re-init
allocinfo_show()
ct->filename <-- UAF
After free_mod_mem() frees the module's .rodata, allocinfo_show()
dereferences ct->filename, ct->function which point there.
Save the iterator state in allocinfo_next() and resume from it in
allocinfo_start() with codetag_next_ct(), which detects module removal via
idr_find() returning NULL and skips to the next module.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/alloc_tag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37e3e8a2c3bfdd503209f043f8bbfbdcf5a1d92f",
"status": "affected",
"version": "9f44df50fee4d2f6cb374177244ccfa9f0a5cc95",
"versionType": "git"
},
{
"lessThan": "008ceffd44040f809aead6d7bef7cb1210c4149a",
"status": "affected",
"version": "9f44df50fee4d2f6cb374177244ccfa9f0a5cc95",
"versionType": "git"
},
{
"lessThan": "2956268efc457cb05d29c1bf94de1e8e684d7bbc",
"status": "affected",
"version": "9f44df50fee4d2f6cb374177244ccfa9f0a5cc95",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/alloc_tag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nalloc_tag: fix use-after-free in /proc/allocinfo after module unload\n\nallocinfo_start() only reinitializes the codetag iterator at position 0. \nFor subsequent reads (position \u003e 0), it reuses cached iterator state from\nthe previous batch. allocinfo_stop() drops mod_lock between read batches,\nwhich allows module unload to complete and free the module memory that the\ncached iterator still references:\n\n CPU0 (read) CPU1 (rmmod)\n ---- ----\n allocinfo_start(pos=0)\n down_read(mod_lock)\n allocinfo_show()\n ...\n allocinfo_stop()\n up_read(mod_lock)\n codetag_unload_module()\n kfree(cmod)\n release_module_tags()\n ...\n free_mod_mem()\n allocinfo_start(pos=N)\n down_read(mod_lock)\n // reuses cached iter, skips re-init\n allocinfo_show()\n ct-\u003efilename \u003c-- UAF\n\nAfter free_mod_mem() frees the module\u0027s .rodata, allocinfo_show()\ndereferences ct-\u003efilename, ct-\u003efunction which point there.\n\nSave the iterator state in allocinfo_next() and resume from it in\nallocinfo_start() with codetag_next_ct(), which detects module removal via\nidr_find() returning NULL and skips to the next module."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:14:31.058Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37e3e8a2c3bfdd503209f043f8bbfbdcf5a1d92f"
},
{
"url": "https://git.kernel.org/stable/c/008ceffd44040f809aead6d7bef7cb1210c4149a"
},
{
"url": "https://git.kernel.org/stable/c/2956268efc457cb05d29c1bf94de1e8e684d7bbc"
}
],
"title": "alloc_tag: fix use-after-free in /proc/allocinfo after module unload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72431",
"datePublished": "2026-08-15T05:56:46.821Z",
"dateReserved": "2026-08-09T03:40:39.929Z",
"dateUpdated": "2026-08-17T05:14:31.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…