CyberSecBulletin
CVE-2026-72072NVD status: Received

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-72072 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb, 218cc15a4c907659ad4b0e68c535c61594311205, 4a5073b7b30243658f58b2d2d35a823da7fd34d9 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb or 218cc15a4c907659ad4b0e68c535c61594311205 or 4a5073b7b30243658f58b2d2d35a823da7fd34d9 or ed3cc4218070d6b98bf5fb456dccae424fd38c4f, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb7c9400cbc48c3713190b3bce4e0c87e924e4104 up to, but not including, b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb; b7c9400cbc48c3713190b3bce4e0c87e924e4104 up to, but not including, 218cc15a4c907659ad4b0e68c535c61594311205; b7c9400cbc48c3713190b3bce4e0c87e924e4104 up to, but not including, 4a5073b7b30243658f58b2d2d35a823da7fd34d9; b7c9400cbc48c3713190b3bce4e0c87e924e4104 up to, but not including, ed3cc4218070d6b98bf5fb456dccae424fd38c4f; b7c9400cbc48c3713190b3bce4e0c87e924e4104 up to, but not including, 088873af13590ebde10de2ade847f57a05ec61c6; b7c9400cbc48c3713190b3bce4e0c87e924e4104 up to, but not including, de74d8fd10291763d97b218f09adcc7513c975e4; 6.1b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb, 218cc15a4c907659ad4b0e68c535c61594311205, 4a5073b7b30243658f58b2d2d35a823da7fd34d9, ed3cc4218070d6b98bf5fb456dccae424fd38c4f, 088873af13590ebde10de2ade847f57a05ec61c6, de74d8fd10291763d97b218f09adcc7513c975e4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory. Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken. mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc->md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath. Note: macsec_del_rxsc_ctx() also kfree()s rx_sc->sc_xarray_element without an RCU grace period while the same datapath reads it under rcu_read_lock(); that is a separate pre-existing issue left to a follow-up patch. Found by 0sec automated security-research tooling (https://0sec.ai).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.