CVE-2026-72357

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72357", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.921Z", "datePublished": "2026-08-15T05:55:58.124Z", "dateUpdated": "2026-08-17T05:43:15.438Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:15.438Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes/x86: Use proper mm_struct in __in_uprobe_trampoline\n\nIn the unregister path we use __in_uprobe_trampoline check with\ncurrent->mm for the VMA lookup, which is wrong, because we are\nin the tracer context, not the traced process.\n\nAdd mm_struct pointer argument to __in_uprobe_trampoline and\nchanging related callers to pass proper mm_struct pointer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachable only via local syscalls (bpf/BPF_PROG_LOAD, bpf/BPF_LINK_CREATE for uprobes, perf_event_open, close/exit) that register and tear down x86 optimized uprobes; no network, adjacent, or physical entry path exists.\nAC:L - Syzkaller reproduced this reliably by attaching a BPF uprobe-multi link and exiting; the attacker controls probe registration, target file/offset, and teardown timing, including cases where unregister runs with current->mm NULL or a tracer mm.\nPR:L - Triggering requires CAP_BPF plus CAP_PERFMON for BPF uprobes or CAP_SYS_ADMIN for perf uprobes; these capabilities are grantable inside user namespaces and do not require init-namespace root under kernel CNA guidance.\nUI:N - No victim interaction is required; a local attacker fully drives uprobe attach and unregister (including process exit closing the BPF link), without needing another user to open files or perform actions.\nS:U - Impact stays within the kernel/host privilege domain (kernel panic and corruption of probed process executable text); it does not cross a VM, container, or IOMMU security boundary that would change CVSS scope.\nC:H - Using the wrong mm for trampoline VMA lookup can mis-detect optimization state and drive int3_update/unoptimize on executable pages; this class of kernel memory corruption is exploitable for information disclosure, not merely a bounded leak.\nI:H - Incorrect is_optimized decisions during unregister can invoke swbp_unoptimize/int3_update on the traced vma, writing attacker-influenced instruction bytes into executable mappings and enabling control-flow hijack in the probed process.\nA:H - Syzkaller hit a KASAN null-ptr-deref GPF in mtree_load via set_orig_insn during bpf_uprobe_multi_link_release on process exit, producing an oops and kernel panic; repeated attach/exit can deny service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/uprobes.c"], "versions": [{"version": "ba2bfc97b4629b10bd8d02b36e04f3932a04cac4", "lessThan": "c9170c83b0e0fc2065a4c2bca5bf1f90c5880156", "status": "affected", "versionType": "git"}, {"version": "ba2bfc97b4629b10bd8d02b36e04f3932a04cac4", "lessThan": "1acddd3e22dd6912dd5d54f80462405a1f1e6bae", "status": "affected", "versionType": "git"}, {"version": "ba2bfc97b4629b10bd8d02b36e04f3932a04cac4", "lessThan": "169328645663bae30e9abad4012d52441e085a71", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/uprobes.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c9170c83b0e0fc2065a4c2bca5bf1f90c5880156"}, {"url": "https://git.kernel.org/stable/c/1acddd3e22dd6912dd5d54f80462405a1f1e6bae"}, {"url": "https://git.kernel.org/stable/c/169328645663bae30e9abad4012d52441e085a71"}], "title": "uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kernel/uprobes.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c9170c83b0e0fc2065a4c2bca5bf1f90c5880156", "status": "affected", "version": "ba2bfc97b4629b10bd8d02b36e04f3932a04cac4", "versionType": "git"}, {"lessThan": "1acddd3e22dd6912dd5d54f80462405a1f1e6bae", "status": "affected", "version": "ba2bfc97b4629b10bd8d02b36e04f3932a04cac4", "versionType": "git"}, {"lessThan": "169328645663bae30e9abad4012d52441e085a71", "status": "affected", "version": "ba2bfc97b4629b10bd8d02b36e04f3932a04cac4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kernel/uprobes.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes/x86: Use proper mm_struct in __in_uprobe_trampoline\n\nIn the unregister path we use __in_uprobe_trampoline check with\ncurrent->mm for the VMA lookup, which is wrong, because we are\nin the tracer context, not the traced process.\n\nAdd mm_struct pointer argument to __in_uprobe_trampoline and\nchanging related callers to pass proper mm_struct pointer."}], "id": "CVE-2026-72357", "lastModified": "2026-08-17T06:18:39.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:09.147", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/169328645663bae30e9abad4012d52441e085a71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1acddd3e22dd6912dd5d54f80462405a1f1e6bae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9170c83b0e0fc2065a4c2bca5bf1f90c5880156"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline", "id": "2516300", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516300"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-344", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nuprobes/x86: Use proper mm_struct in __in_uprobe_trampoline\nIn the unregister path we use __in_uprobe_trampoline check with\ncurrent->mm for the VMA lookup, which is wrong, because we are\nin the tracer context, not the traced process.\nAdd mm_struct pointer argument to __in_uprobe_trampoline and\nchanging related callers to pass proper mm_struct pointer.", "A flaw was found in the Linux kernel's uprobes/x86 component. The `__in_uprobe_trampoline` function incorrectly uses the current process's memory management (`current->mm`) for Virtual Memory Area (VMA) lookups during the unregistration process. This occurs because the lookup is performed in the tracer's context rather than the traced process's context. This improper memory management could lead to unexpected system behavior or stability issues."], "name": "CVE-2026-72357", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72357\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72357\nhttps://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72357-0b6c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ba2bfc97b4629b10bd8d02b36e04f3932a04cac4,c9170c83b0e0fc2065a4c2bca5bf1f90c5880156)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ba2bfc97b4629b10bd8d02b36e04f3932a04cac4,1acddd3e22dd6912dd5d54f80462405a1f1e6bae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ba2bfc97b4629b10bd8d02b36e04f3932a04cac4,169328645663bae30e9abad4012d52441e085a71)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:30:12.332156+00:00", "updated": "2026-08-22T08:15:03.805855+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}