{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72357","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.921Z","datePublished":"2026-08-15T05:55:58.124Z","dateUpdated":"2026-08-17T05:43:15.438Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:43:15.438Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes/x86: Use proper mm_struct in __in_uprobe_trampoline\n\nIn the unregister path we use __in_uprobe_trampoline check with\ncurrent->mm for the VMA lookup, which is wrong, because we are\nin the tracer context, not the traced process.\n\nAdd mm_struct pointer argument to __in_uprobe_trampoline and\nchanging related callers to pass proper mm_struct pointer."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Reachable only via local syscalls (bpf/BPF_PROG_LOAD, bpf/BPF_LINK_CREATE for uprobes, perf_event_open, close/exit) that register and tear down x86 optimized uprobes; no network, adjacent, or physical entry path exists.\nAC:L - Syzkaller reproduced this reliably by attaching a BPF uprobe-multi link and exiting; the attacker controls probe registration, target file/offset, and teardown timing, including cases where unregister runs with current->mm NULL or a tracer mm.\nPR:L - Triggering requires CAP_BPF plus CAP_PERFMON for BPF uprobes or CAP_SYS_ADMIN for perf uprobes; these capabilities are grantable inside user namespaces and do not require init-namespace root under kernel CNA guidance.\nUI:N - No victim interaction is required; a local attacker fully drives uprobe attach and unregister (including process exit closing the BPF link), without needing another user to open files or perform actions.\nS:U - Impact stays within the kernel/host privilege domain (kernel panic and corruption of probed process executable text); it does not cross a VM, container, or IOMMU security boundary that would change CVSS scope.\nC:H - Using the wrong mm for trampoline VMA lookup can mis-detect optimization state and drive int3_update/unoptimize on executable pages; this class of kernel memory corruption is exploitable for information disclosure, not merely a bounded leak.\nI:H - Incorrect is_optimized decisions during unregister can invoke swbp_unoptimize/int3_update on the traced vma, writing attacker-influenced instruction bytes into executable mappings and enabling control-flow hijack in the probed process.\nA:H - Syzkaller hit a KASAN null-ptr-deref GPF in mtree_load via set_orig_insn during bpf_uprobe_multi_link_release on process exit, producing an oops and kernel panic; repeated attach/exit can deny service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/uprobes.c"],"versions":[{"version":"ba2bfc97b4629b10bd8d02b36e04f3932a04cac4","lessThan":"c9170c83b0e0fc2065a4c2bca5bf1f90c5880156","status":"affected","versionType":"git"},{"version":"ba2bfc97b4629b10bd8d02b36e04f3932a04cac4","lessThan":"1acddd3e22dd6912dd5d54f80462405a1f1e6bae","status":"affected","versionType":"git"},{"version":"ba2bfc97b4629b10bd8d02b36e04f3932a04cac4","lessThan":"169328645663bae30e9abad4012d52441e085a71","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/x86/kernel/uprobes.c"],"versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c9170c83b0e0fc2065a4c2bca5bf1f90c5880156"},{"url":"https://git.kernel.org/stable/c/1acddd3e22dd6912dd5d54f80462405a1f1e6bae"},{"url":"https://git.kernel.org/stable/c/169328645663bae30e9abad4012d52441e085a71"}],"title":"uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline","x_generator":{"engine":"bippy-1.2.0"}}}}