GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89750 (GCVE-0-2026-89750)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
tracing/user_events: Clear copied tracing state before fork duplication
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails. When the child exits, user_event_mm_remove() decrements a reference the child never owned, which ultimately frees user_event_mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as: BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44 Call Trace: <TASK> kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 current_user_event_mm+0x51/0x1d0 user_events_ioctl+0x82e/0x15c0 __x64_sys_ioctl+0x139/0x1c0 do_syscall_64+0xce/0x450 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 44: __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x180/0x3a0 user_event_mm_alloc+0x3c/0x1f0 current_user_event_mm+0x88/0x1d0 Freed by task 42: __kasan_slab_free+0x43/0x70 kfree+0x13a/0x390 process_one_work+0x696/0xf90 worker_thread+0x420/0xba0 The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 33ce55b368b64d65941867add00e7f288cbb8234 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 63b39e49a4c9d68e010e96b26fc7374f0864f2b1 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 25a0758cf6bdbfddac2be71124c9bd0692f4b0b1 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < b799f67119aff179719a0b1e12441ebbdaaf62f9 (git)
Affected: 7235759084a4f8524a46bd2638885ff3b34ce279 , < 390f6bd8583d177029d9df4bea6667509e55a765 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "33ce55b368b64d65941867add00e7f288cbb8234",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "63b39e49a4c9d68e010e96b26fc7374f0864f2b1",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "25a0758cf6bdbfddac2be71124c9bd0692f4b0b1",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "b799f67119aff179719a0b1e12441ebbdaaf62f9",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            },
            {
              "lessThan": "390f6bd8583d177029d9df4bea6667509e55a765",
              "status": "affected",
              "version": "7235759084a4f8524a46bd2638885ff3b34ce279",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Clear copied tracing state before fork duplication\n\ndup_task_struct() copies user_event_mm from the parent into the child,\nwithout grabbing a reference to it. user_event_mm_dup() should\nreplace it, but it leaves that copied pointer unmodified if\nuser_event_mm_alloc() fails.\n\nWhen the child exits, user_event_mm_remove() decrements a reference\nthe child never owned, which ultimately frees user_event_mm, while\nthe parent still as a stale pointer to it. This creates a UAF, which\nKASAN reports as:\n\n    BUG: KASAN: slab-use-after-free in\n    current_user_event_mm+0x51/0x1d0 Write of size 4 at addr\n    ffff888005010d30 by task init/44\n\n    Call Trace:\n     \u003cTASK\u003e\n     kasan_report+0xce/0x100\n     kasan_check_range+0x10f/0x1e0\n     current_user_event_mm+0x51/0x1d0\n     user_events_ioctl+0x82e/0x15c0\n     __x64_sys_ioctl+0x139/0x1c0\n     do_syscall_64+0xce/0x450\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n    Allocated by task 44:\n     __kasan_kmalloc+0x8f/0xa0\n     __kmalloc_cache_noprof+0x180/0x3a0\n     user_event_mm_alloc+0x3c/0x1f0\n     current_user_event_mm+0x88/0x1d0\n\n    Freed by task 42:\n     __kasan_slab_free+0x43/0x70\n     kfree+0x13a/0x390\n     process_one_work+0x696/0xf90\n     worker_thread+0x420/0xba0\n\nThe fix simply clears the copied pointer before any possible failure.\nIn case of failure, the child then has nothing to free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local syscalls: ioctl(DIAG_IOCSREG) on tracefs user_events_data to create a user_event_mm, then fork/clone without CLONE_VM so dup_task_struct copies the pointer and user_event_mm_dup fails to replace it. No network, adjacent-wireless, or physical path exists.\nAC:L - The attacker controls the full sequence (register an enabler, apply memory pressure, fork, exit the child). user_event_enabler_dup uses GFP_NOWAIT, which fails readily under attacker-generated pressure, and user_event_mm_alloc is GFP_KERNEL_ACCOUNT and can fail under memcg limits; no victim-side race is required.\nPR:L - Non-persist DIAG_IOCSREG has no CAP_SYS_ADMIN or perfmon check; only write access to tracefs user_events_data is required. Tracing deployments (Android/Perfetto, ChromeOS, tracefs gid mounts) grant that to unprivileged local users, matching the intended user_events ABI.\nUI:N - The attacker registers a user event, forks, and exits the child entirely within their own process; no victim action, extra mount, or cooperating user is required.\nS:U - The use-after-free is of a kernel-heap user_event_mm during local fork/exit handling and does not cross a VM, IOMMU, or sandbox boundary; impact is standard in-kernel memory corruption on the same host.\nC:H - Child exit frees the parent\u0027s user_event_mm while the parent retains a stale pointer; later ioctl paths (current_user_event_mm refcount_inc, enabler list walks, mm-\u003emm dereference) read reclaimed slab contents, yielding an attacker-groomable kernel memory disclosure primitive.\nI:H - The dangling user_event_mm is written after kfree (refcount_inc, list updates, mmap locks on mm-\u003emm), so slab reuse enables heap spray and arbitrary kernel writes or control-flow hijack, consistent with UAF scoring guidance.\nA:H - KASAN reports a slab-use-after-free write in current_user_event_mm after the child exits, and repeating fork-under-pressure plus parent ioctl or exit reliably oopses or panics the kernel even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:29.948Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/33ce55b368b64d65941867add00e7f288cbb8234"
        },
        {
          "url": "https://git.kernel.org/stable/c/63b39e49a4c9d68e010e96b26fc7374f0864f2b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/25a0758cf6bdbfddac2be71124c9bd0692f4b0b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b799f67119aff179719a0b1e12441ebbdaaf62f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/390f6bd8583d177029d9df4bea6667509e55a765"
        }
      ],
      "title": "tracing/user_events: Clear copied tracing state before fork duplication",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89750",
    "datePublished": "2026-09-11T19:46:54.565Z",
    "dateReserved": "2026-09-11T19:38:34.762Z",
    "dateUpdated": "2026-09-14T12:02:29.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89750",
      "date": "2026-09-17",
      "epss": "0.00159",
      "percentile": "0.05443"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:56:53.000Z",
      "cve": "CVE-2026-89750",
      "id": "msrc_CVE-2026-89750",
      "initial_release_date": "2026-09-13T01:09:51.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing/user_events: Clear copied tracing state before fork duplication",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89750.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89750\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:05.883\",\"lastModified\":\"2026-09-14T13:19:23.640\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/user_events: Clear copied tracing state before fork duplication\\n\\ndup_task_struct() copies user_event_mm from the parent into the child,\\nwithout grabbing a reference to it. user_event_mm_dup() should\\nreplace it, but it leaves that copied pointer unmodified if\\nuser_event_mm_alloc() fails.\\n\\nWhen the child exits, user_event_mm_remove() decrements a reference\\nthe child never owned, which ultimately frees user_event_mm, while\\nthe parent still as a stale pointer to it. This creates a UAF, which\\nKASAN reports as:\\n\\n    BUG: KASAN: slab-use-after-free in\\n    current_user_event_mm+0x51/0x1d0 Write of size 4 at addr\\n    ffff888005010d30 by task init/44\\n\\n    Call Trace:\\n     \u003cTASK\u003e\\n     kasan_report+0xce/0x100\\n     kasan_check_range+0x10f/0x1e0\\n     current_user_event_mm+0x51/0x1d0\\n     user_events_ioctl+0x82e/0x15c0\\n     __x64_sys_ioctl+0x139/0x1c0\\n     do_syscall_64+0xce/0x450\\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\n    Allocated by task 44:\\n     __kasan_kmalloc+0x8f/0xa0\\n     __kmalloc_cache_noprof+0x180/0x3a0\\n     user_event_mm_alloc+0x3c/0x1f0\\n     current_user_event_mm+0x88/0x1d0\\n\\n    Freed by task 42:\\n     __kasan_slab_free+0x43/0x70\\n     kfree+0x13a/0x390\\n     process_one_work+0x696/0xf90\\n     worker_thread+0x420/0xba0\\n\\nThe fix simply clears the copied pointer before any possible failure.\\nIn case of failure, the child then has nothing to free.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_events_user.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7235759084a4f8524a46bd2638885ff3b34ce279\",\"lessThan\":\"33ce55b368b64d65941867add00e7f288cbb8234\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7235759084a4f8524a46bd2638885ff3b34ce279\",\"lessThan\":\"63b39e49a4c9d68e010e96b26fc7374f0864f2b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7235759084a4f8524a46bd2638885ff3b34ce279\",\"lessThan\":\"25a0758cf6bdbfddac2be71124c9bd0692f4b0b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7235759084a4f8524a46bd2638885ff3b34ce279\",\"lessThan\":\"b799f67119aff179719a0b1e12441ebbdaaf62f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7235759084a4f8524a46bd2638885ff3b34ce279\",\"lessThan\":\"390f6bd8583d177029d9df4bea6667509e55a765\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_events_user.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/25a0758cf6bdbfddac2be71124c9bd0692f4b0b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/33ce55b368b64d65941867add00e7f288cbb8234\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/390f6bd8583d177029d9df4bea6667509e55a765\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63b39e49a4c9d68e010e96b26fc7374f0864f2b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b799f67119aff179719a0b1e12441ebbdaaf62f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:52:43+00:00",
      "cve": "CVE-2026-89750",
      "id": "CVE-2026-89750",
      "initial_release_date": "2026-09-11T19:46:54.565000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-After-Free in tracing/user_events component",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89750.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:56:25Z",
      "cve": "CVE-2026-89750",
      "id": "CVE-2026-89750",
      "initial_release_date": "2026-09-12T16:22:15Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89750",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89750.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.