Linux Kernel EUVD-2026-59256

The Linux kernel uprobes subsystem enables dynamic user-space instrumentation by placing software breakpoints in user-space code and managing execution via a kernel-controlled trampoline page used for safe single-stepping. The function __in_uprobe_trampoline determines whether a given program counter falls within this trampoline region by performing a VMA (Virtual Memory Area) lookup against a process's mm_struct. The root cause is a context confusion bug: during the uprobe unregister (cleanup) path, the function incorrectly uses current->mm, which resolves to the tracer's own address space, rather than the mm_struct of the traced (target) process. Because the tracer and the traced process maintain separate virtual address spaces, the VMA lookup can return incorrect or NULL results, leading to kernel-level memory access errors. The fix, applied across three stable commits, adds an explicit mm_struct pointer argument to __in_uprobe_trampoline and updates all callers to pass the correct struct. The CWE classification is not provided by NVD, but the root cause is best characterized as a use-of-wrong-pointer or incorrect-context error (analogous to CWE-822, Use of Wrong Type, or a general pointer confusion class). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.