Look up another CVE · open CVE-2026-72357 in the interactive tracker
CVE-2026-72357
uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem arch/x86. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-72357 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In the unregister path we use __in_uprobe_trampoline check with current->mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process. Add mm_struct pointer argument to __in_uprobe_trampoline and changing related callers to pass proper mm_struct pointer.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
arch/x86/kernel/uprobes.c
- What this is
- UPROBESMAINTAINERS section matched on arch/*/kernel/uprobes.c · linux-kernel@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_UPROBES /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_UPROBES
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- arch/x86
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.18 | 6.18.40 | c9170c83b0e0 |
| 6.18 | 7.1.5 | 1acddd3e22dd |
| 6.18 | 7.2 | 169328645663 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Reachable only via local syscalls (bpf/BPF_PROG_LOAD, bpf/BPF_LINK_CREATE for uprobes, perf_event_open, close/exit) that register and tear down x86 optimized uprobes; no network, adjacent, or physical entry path exists.
- AC:LAttack complexity, low
- Syzkaller reproduced this reliably by attaching a BPF uprobe-multi link and exiting; the attacker controls probe registration, target file/offset, and teardown timing, including cases where unregister runs with current->mm NULL or a tracer mm.
- PR:LPrivileges required, low
- Triggering requires CAP_BPF plus CAP_PERFMON for BPF uprobes or CAP_SYS_ADMIN for perf uprobes; these capabilities are grantable inside user namespaces and do not require init-namespace root under kernel CNA guidance.
- UI:NUser interaction, none
- No victim interaction is required; a local attacker fully drives uprobe attach and unregister (including process exit closing the BPF link), without needing another user to open files or perform actions.
- S:UScope, unchanged
- Impact stays within the kernel/host privilege domain (kernel panic and corruption of probed process executable text); it does not cross a VM, container, or IOMMU security boundary that would change CVSS scope.
- C:HConfidentiality impact, high
- Using the wrong mm for trampoline VMA lookup can mis-detect optimization state and drive int3_update/unoptimize on executable pages; this class of kernel memory corruption is exploitable for information disclosure, not merely a bounded leak.
- I:HIntegrity impact, high
- Incorrect is_optimized decisions during unregister can invoke swbp_unoptimize/int3_update on the traced vma, writing attacker-influenced instruction bytes into executable mappings and enabling control-flow hijack in the probed process.
- A:HAvailability impact, high
- Syzkaller hit a KASAN null-ptr-deref GPF in mtree_load via set_orig_insn during bpf_uprobe_multi_link_release on process exit, producing an oops and kernel panic; repeated attach/exit can deny service.