EUVD-2026-76662
GHSA-pf29-fjpw-v4g4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reliable exploitation requires both CONFIG_USER_EVENTS=y and inducing a slab allocation failure during fork, raising AC to High over the vendor's AC:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tracing/user_events: Clear copied tracing state before fork duplication
dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails.
When the child exits, user_event_mm_remove() decrements a reference the child never owned, which ultimately frees user_event_mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as:
BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44
Call Trace: <TASK> kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 current_user_event_mm+0x51/0x1d0 user_events_ioctl+0x82e/0x15c0 __x64_sys_ioctl+0x139/0x1c0 do_syscall_64+0xce/0x450 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 44: __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x180/0x3a0 user_event_mm_alloc+0x3c/0x1f0 current_user_event_mm+0x88/0x1d0
Freed by task 42: __kasan_slab_free+0x43/0x70 kfree+0x13a/0x390 process_one_work+0x696/0xf90 worker_thread+0x420/0xba0
The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.
AnalysisAI
UAF in the Linux kernel's user_events tracing subsystem (present since kernel 6.4) allows a local unprivileged user to trigger a reference-count underflow during fork failure, freeing the parent process's user_event_mm slab object while the parent retains a stale pointer. Any subsequent user_events ioctl() call by the parent dereferences the freed memory, enabling a write primitive that can lead to local privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a Linux kernel version 6.4 or later compiled with CONFIG_USER_EVENTS=y (the feature must be present - kernels without it are entirely unaffected); (2) a local unprivileged user account (PR:L per the CVSS vector); (3) the ability to induce a user_event_mm_alloc() failure during fork(), which requires creating memory pressure sufficient to cause slab allocation failure - this is the critical gate that makes exploitation unreliable and raises practical attack complexity above the CVSS AC:L rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) correctly identifies the local, low-privilege attack surface and the potential for full impact via an arbitrary slab write primitive, but AC:L is optimistic - reliable triggering requires inducing a user_event_mm_alloc() failure in the child, which demands controlled memory pressure or OOM conditions not trivially achievable in hardened environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, which contain the one-line correction that NULLs the copied user_event_mm pointer in the child before any allocation attempt, ensuring the child has nothing to free on failure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployed Linux systems running kernel versions 6.4 through the latest release and verify whether user_events tracing is enabled in your kernel configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today