CyberSecBulletin
CVE-2026-72069NVD status: Received

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-72069 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions af28d801cd2db4cc7378554499bd4a5d84a5517e, 9d1fcd64ab81200e02b7a6db5eb1da8e244e8289, 3cfaac77b3c32ac3940df28866de263c3f45d24c as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.73% chance of exploitation within 30 days, higher than 55% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to af28d801cd2db4cc7378554499bd4a5d84a5517e or 9d1fcd64ab81200e02b7a6db5eb1da8e244e8289 or 3cfaac77b3c32ac3940df28866de263c3f45d24c or 1f0d56d3f1e88f20f6e46109402f8c15d59bac37, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, af28d801cd2db4cc7378554499bd4a5d84a5517e; 0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, 9d1fcd64ab81200e02b7a6db5eb1da8e244e8289; 0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, 3cfaac77b3c32ac3940df28866de263c3f45d24c; 0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, 1f0d56d3f1e88f20f6e46109402f8c15d59bac37; 0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, 633cadbc0b8323f5cc140a285d2432089dbb534e; 0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, 83f9fb561c1c3917e19f95523dd933c7d30291aa; 0f383b6dc96e976dfbf2721b0bf10bd96103b341 up to, but not including, 89038cc87d80c77e7aa6f42a64b2573b74af339f; 5.15af28d801cd2db4cc7378554499bd4a5d84a5517e, 9d1fcd64ab81200e02b7a6db5eb1da8e244e8289, 3cfaac77b3c32ac3940df28866de263c3f45d24c, 1f0d56d3f1e88f20f6e46109402f8c15d59bac37, 633cadbc0b8323f5cc140a285d2432089dbb534e, 83f9fb561c1c3917e19f95523dd933c7d30291aa

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin_lock(&p->lock); rcu_read_lock(); invalidate(p); p = rcu_dereference(ptr); rcu_assign_pointer(ptr, NULL); if (!p) return; spin_unlock(&p->lock); spin_lock(&p->lock) lock(&lock->lock); rcu_read_lock(); kfree_rcu(p); rcu_read_unlock(); .... spin_unlock(&p->lock) rcu_read_unlock(); // Ends grace period rcu_do_batch() kfree(p); UAF -> rt_mutex_cmpxchg_release(&lock->lock...) Regular spinlocks keep preemption disabled accross the unlock operation, which provides full RCU protection, but the RT substitution fails to resemble that. Same applies for the rwlock substitution. Move the rcu_read_unlock() invocation past the unlock operations to match the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but that's harmless as the caller needs to hold RCU read lock across the lock operation. The migrate_enable() call stays before the unlock operation because there is no per CPU operation in the unlock path which would require migration to be kept disabled.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.