CVE-2026-89750
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in how the Linux kernel handles tracing information during process creation can let a local user crash the system or potentially take control of it.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in Linux kernel user_events tracing: dup_task_struct copies user_event_mm without reference, and user_event_mm_dup leaves stale pointer on user_event_mm_alloc failure, causing reference decrement and free of still-referenced object on child exit.
Why it matters to the business
Local attackers on affected Linux systems can trigger kernel memory corruption leading to crashes, privilege escalation, or system compromise, especially on hosts relying on user_events tracing for observability.
How an attack unfolds
Attacker runs a process that registers user events, triggers fork under conditions where user_event_mm_alloc fails in the child, then exits the child to decrement the parent's reference count, resulting in UAF write when parent later accesses the freed structure via current_user_event_mm during ioctl.
How to fix it
Apply the upstream kernel fix that clears the copied user_event_mm pointer before attempting allocation in user_event_mm_dup; rebuild and deploy patched kernel images to all affected systems.
How to confirm the fix worked
Inspect kernel source for user_event_mm_dup ensuring pointer is zeroed prior to any failure path; verify KASAN no longer reports slab-use-after-free in current_user_event_mm after fork stress tests.
Typical attack path
- Register user event via user_events interface in parent process
- Trigger fork syscall while forcing allocation failure in child
- Allow child process to exit triggering erroneous kfree
- Parent performs ioctl on user_events triggering access to freed slab object
How to detect it
Search kernel logs and KASAN output for slab-use-after-free involving current_user_event_mm and user_events_ioctl; correlate with process creation and exit events around tracing ioctls.
- BUG: KASAN: slab-use-after-free in current_user_event_mm
- user_events_ioctl+0x82e/0x15c0
- user_event_mm_remove
- current_user_event_mm+0x51/0x1d0
What your security team should do
- Patch Linux kernels with the provided fix at earliest opportunity
- Disable user_events tracing on systems where not required
- Monitor kernel update channels for backports to supported distributions
The record
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails. When the child exits, user_event_mm_remove() decrements a reference the child never owned, which ultimately frees user_event_mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as: BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44 Call Trace: <TASK> kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 current_user_event_mm+0x51/0x1d0 user_events_ioctl+0x82e/0x15c0 __x64_sys_ioctl+0x139/0x1c0 do_syscall_64+0xce/0x450 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 44: __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x180/0x3a0 user_event_mm_alloc+0x3c/0x1f0 current_user_event_mm+0x88/0x1d0 Freed by task 42: __kasan_slab_free+0x43/0x70 kfree+0x13a/0x390 process_one_work+0x696/0xf90 worker_thread+0x420/0xba0 The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|