CVE-2026-72080— fs/resctrl: Fix use-after-free during unmount
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.16版本存在安全漏洞，该漏洞源于fs/resctrl在卸载过程中未设置RDT_DELETED标志，导致并发读取器访问已释放的文件私有数据，可能引发释放后重用。
Possible ATT&CK Techniques 1 AI
T1135 · Network Share DiscoveryAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2a65660385444e9d9deffe995c71ee20443ef76e< 7b7bb07efe41bb646a93c4624aa2bb35df190342 |
affected |
2a65660385444e9d9deffe995c71ee20443ef76e< 7d330a1d663381579b9d5dafa642b1b3158a0ce2 |
affected | ||
2a65660385444e9d9deffe995c71ee20443ef76e< 52fce648607e0d6a76eeb443d78708c49df1c554 |
affected | ||
6.16 |
affected | ||
< 6.16 |
unaffected | ||
6.18.42≤ 6.18.* |
unaffected | ||
7.1.5≤ 7.1.* |
unaffected | ||
7.2≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72080
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fs/resctrl: Fix use-after-free during unmount
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
fs/resctrl: Fix use-after-free during unmount
During unmount or failure teardown all mon_data structures that contain
monitoring event file private data are freed after which kernfs nodes are
removed. However, the RDT_DELETED flag is never set for the statically
allocated default resource group.
A concurrent reader of an event file associated with the default resource
group may, after dropping kernfs active protection, block on rdtgroup_mutex
while unmount proceeds to free the file private data and destroy the kernfs
node without waiting for the reader.
When the mutex is released, the reader wakes up, observes that RDT_DELETED
is not set for the default group, and dereferences the already-freed
file private data.
The scenario can be depicted as follows:
CPU0 CPU1
/*
* Default resource group's
* monitoring data accessible via
* kernfs file with kernfs_node::priv
* pointing to a struct mon_data.
* User opens the file for reading.
*/
rdtgroup_mondata_show() /* arch encounters fatal error */
rdtgroup_kn_lock_live() resctrl_exit()
atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock()
kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex)
cpus_read_lock() resctrl_fs_teardown()
mutex_lock(&rdtgroup_mutex) rmdir_all_sub()
mon_put_kn_priv()
/* Delete all mon_data structures */
rdtgroup_destroy_root()
kernfs_destroy_root()
rdtgroup_default.kn = NULL
mutex_unlock(&rdtgroup_mutex)
/*
* rdtgroup_default.flags is empty so
* rdtgroup_kn_lock_live() returns
* &rdtgroup_default
*/
md = of->kn->priv;
/* md points to freed mon_data */
Set RDT_DELETED for the default group unconditionally since the flag does
not lead to the freeing of this statically allocated group.
Do not allow a new resctrl mount if there are any waiters on default group
of previous mount. A new mount will re-initialize the default group that
would appear to waiters from previous mount as though the default group is
accessible causing them to access the mon_data structures from the previous
mount that have been removed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.16版本存在安全漏洞，该漏洞源于fs/resctrl在卸载过程中未设置RDT_DELETED标志，导致并发读取器访问已释放的文件私有数据，可能引发释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-72080
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72080
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-72080 (3)
Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total
| CVE-2026-74475 | 10.0 CRITICAL | vxlan: use neigh_ha_snapshot() in route_shortcircuit() |
| CVE-2026-74279 | 10.0 CRITICAL | crypto: cavium/cpt - fix DMA cleanup using wrong loop index |
| CVE-2026-74280 | 10.0 CRITICAL | crypto: marvell/octeontx - fix DMA cleanup using wrong loop index |
| CVE-2026-74309 | 10.0 CRITICAL | vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler |
| CVE-2026-72407 | 10.0 CRITICAL | geneve: validate inner network offset in geneve_gro_complete() |
| CVE-2026-72408 | 10.0 CRITICAL | geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint |
| CVE-2026-72421 | 10.0 CRITICAL | ipv4: fib: Don't ignore error route in local/main tables. |
| CVE-2026-72493 | 9.9 CRITICAL | net: serialize netif_running() check in enqueue_to_backlog() |
| CVE-2026-74545 | 9.8 CRITICAL | rtase: fix double free of multi-frag skb on DMA map failure |
| CVE-2026-72322 | 9.8 CRITICAL | ipv6: mcast: Fix potential UAF in MLD delayed work |
| CVE-2026-72429 | 9.8 CRITICAL | ipv6: ioam: fix type confusion of dst_entry |
| CVE-2026-72129 | 9.8 CRITICAL | nvmet-rdma: handle inline data with a nonzero offset |
| CVE-2026-72130 | 9.8 CRITICAL | nvmet-auth: reject short AUTH_RECEIVE buffers |
| CVE-2026-72436 | 9.8 CRITICAL | netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types |
| CVE-2026-72206 | 9.8 CRITICAL | ntfs: validate index block header more strictly |
| CVE-2026-72319 | 9.8 CRITICAL | ipvs: ensure inner headers in ICMP errors are in headroom |
| CVE-2026-72317 | 9.8 CRITICAL | SUNRPC: pin upper rpc_clnt across the TLS connect_worker |
| CVE-2026-72137 | 9.8 CRITICAL | xfrm: nat_keepalive: avoid double free on send error |
| CVE-2026-74427 | 9.8 CRITICAL | afs: Fix netns teardown to cancel the preallocation charger |
| CVE-2026-74433 | 9.8 CRITICAL | rxrpc: Fix UAF in rxgk_issue_challenge() |
Showing top 20 of 845 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
V. Comments for CVE-2026-72080
No comments yet