CVE-2026-72431alloc_tag: fix use-after-free in /proc/allocinfo after module unload
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: alloc_tag: fix use-after-free in /proc/allocinfo after module unload allocinfo_start() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfo_stop() drops mod_lock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references: CPU0 (read) CPU1 (rmmod) ---- ---- allocinfo_start(pos=0) down_read(mod_lock) allocinfo_show() ... allocinfo_stop() up_read(mod_lock) codetag_unload_module() kfree(cmod) release_module_tags() ... free_mod_mem() allocinfo_start(pos=N) down_read(mod_lock) // reuses cached iter, skips re-init allocinfo_show() ct->filename <-- UAF After free_mod_mem() frees the module's .rodata, allocinfo_show() dereferences ct->filename, ct->function which point there. Save the iterator state in allocinfo_next() and resume from it in allocinfo_start() with codetag_next_ct(), which detects module removal via idr_find() returning NULL and skips to the next module.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9f44df50fee4d2f6cb374177244ccfa9f0a5cc95 before 37e3e8a2c3bfdd503209f043f8bbfbdcf5a1d92f; 9f44df50fee4d2f6cb374177244ccfa9f0a5cc95 builds before 008ceffd44040f809aead6d7bef7cb1210c4149a; from 9f44df50fee4d2f6cb374177244ccfa9f0a5cc95 before 2956268efc457cb05d29c1bf94de1e8e684d7bbc | CNA record |
References
- https://git.kernel.org/stable/c/37e3e8a2c3bfdd503209f043f8bbfbdcf5a1d92f
- https://git.kernel.org/stable/c/008ceffd44040f809aead6d7bef7cb1210c4149a
- https://git.kernel.org/stable/c/2956268efc457cb05d29c1bf94de1e8e684d7bbc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.