Look up another CVE · open CVE-2026-89750 in the interactive tracker
CVE-2026-89750
tracing/user_events: Clear copied tracing state before fork duplication
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem kernel/trace. Debian urgency: unimportant.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-89750 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails. When the child exits, user_event_mm_remove() decrements a reference the child never owned, which ultimately frees user_event_mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as: BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44 Call Trace: <TASK> kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 current_user_event_mm+0x51/0x1d0 user_events_ioctl+0x82e/0x15c0 __x64_sys_ioctl+0x139/0x1c0 do_syscall_64+0xce/0x450 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 44: __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x180/0x3a0 user_event_mm_alloc+0x3c/0x1f0 current_user_event_mm+0x88/0x1d0 Freed by task 42: __kasan_slab_free+0x43/0x70 kfree+0x13a/0x390 process_one_work+0x696/0xf90 worker_thread+0x420/0xba0 The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/trace/trace_events_user.c
- What this is
- TRACINGMAINTAINERS section matched on kernel/trace/ · linux-kernel@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into trace_events_user, and Debian does not compile it into that module, so finding trace_events_user in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_FUNCTION_TRACER|CONFIG_RETHOOK|CONFIG_RING_BUFFER|CONFIG_TRACEPOINTS|CONFIG_TRACE_CLOCK|CONFIG_TRACING|CONFIG_USER_EVENTS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_FUNCTION_TRACER, CONFIG_RETHOOK, CONFIG_RING_BUFFER, CONFIG_TRACEPOINTS, CONFIG_TRACE_CLOCK, CONFIG_TRACING, CONFIG_USER_EVENTS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/trace
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.4 | 6.6.157 | 33ce55b368b6 |
| 6.4 | 6.12.109 | 63b39e49a4c9 |
| 6.4 | 6.18.50 | 25a0758cf6bd |
| 6.4 | 7.2.4 | b799f67119af |
| 6.4 | 7.3 | 390f6bd8583d |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Reached only via local syscalls: ioctl(DIAG_IOCSREG) on tracefs user_events_data to create a user_event_mm, then fork/clone without CLONE_VM so dup_task_struct copies the pointer and user_event_mm_dup fails to replace it. No network, adjacent-wireless, or physical path exists.
- AC:LAttack complexity, low
- The attacker controls the full sequence (register an enabler, apply memory pressure, fork, exit the child). user_event_enabler_dup uses GFP_NOWAIT, which fails readily under attacker-generated pressure, and user_event_mm_alloc is GFP_KERNEL_ACCOUNT and can fail under memcg limits; no victim-side race is required.
- PR:LPrivileges required, low
- Non-persist DIAG_IOCSREG has no CAP_SYS_ADMIN or perfmon check; only write access to tracefs user_events_data is required. Tracing deployments (Android/Perfetto, ChromeOS, tracefs gid mounts) grant that to unprivileged local users, matching the intended user_events ABI.
- UI:NUser interaction, none
- The attacker registers a user event, forks, and exits the child entirely within their own process; no victim action, extra mount, or cooperating user is required.
- S:UScope, unchanged
- The use-after-free is of a kernel-heap user_event_mm during local fork/exit handling and does not cross a VM, IOMMU, or sandbox boundary; impact is standard in-kernel memory corruption on the same host.
- C:HConfidentiality impact, high
- Child exit frees the parent's user_event_mm while the parent retains a stale pointer; later ioctl paths (current_user_event_mm refcount_inc, enabler list walks, mm->mm dereference) read reclaimed slab contents, yielding an attacker-groomable kernel memory disclosure primitive.
- I:HIntegrity impact, high
- The dangling user_event_mm is written after kfree (refcount_inc, list updates, mmap locks on mm->mm), so slab reuse enables heap spray and arbitrary kernel writes or control-flow hijack, consistent with UAF scoring guidance.
- A:HAvailability impact, high
- KASAN reports a slab-use-after-free write in current_user_event_mm after the child exits, and repeating fork-under-pressure plus parent ioctl or exit reliably oopses or panics the kernel even without a full exploit.