CVE-2026-72080— fs/resctrl: Fix use-after-free during unmount
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.16版本存在安全漏洞，该漏洞源于fs/resctrl在卸载过程中未设置RDT_DELETED标志，导致并发读取器访问已释放的文件私有数据，可能引发释放后重用。
Possible ATT&CK Techniques 1 AI
T1135 · Network Share DiscoveryAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2a65660385444e9d9deffe995c71ee20443ef76e< 7b7bb07efe41bb646a93c4624aa2bb35df190342 |
affected |
2a65660385444e9d9deffe995c71ee20443ef76e< 7d330a1d663381579b9d5dafa642b1b3158a0ce2 |
affected | ||
2a65660385444e9d9deffe995c71ee20443ef76e< 52fce648607e0d6a76eeb443d78708c49df1c554 |
affected | ||
6.16 |
affected | ||
< 6.16 |
unaffected | ||
6.18.42≤ 6.18.* |
unaffected | ||
7.1.5≤ 7.1.* |
unaffected | ||
7.2≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72080
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fs/resctrl: Fix use-after-free during unmount
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
fs/resctrl: Fix use-after-free during unmount
During unmount or failure teardown all mon_data structures that contain
monitoring event file private data are freed after which kernfs nodes are
removed. However, the RDT_DELETED flag is never set for the statically
allocated default resource group.
A concurrent reader of an event file associated with the default resource
group may, after dropping kernfs active protection, block on rdtgroup_mutex
while unmount proceeds to free the file private data and destroy the kernfs
node without waiting for the reader.
When the mutex is released, the reader wakes up, observes that RDT_DELETED
is not set for the default group, and dereferences the already-freed
file private data.
The scenario can be depicted as follows:
CPU0 CPU1
/*
* Default resource group's
* monitoring data accessible via
* kernfs file with kernfs_node::priv
* pointing to a struct mon_data.
* User opens the file for reading.
*/
rdtgroup_mondata_show() /* arch encounters fatal error */
rdtgroup_kn_lock_live() resctrl_exit()
atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock()
kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex)
cpus_read_lock() resctrl_fs_teardown()
mutex_lock(&rdtgroup_mutex) rmdir_all_sub()
mon_put_kn_priv()
/* Delete all mon_data structures */
rdtgroup_destroy_root()
kernfs_destroy_root()
rdtgroup_default.kn = NULL
mutex_unlock(&rdtgroup_mutex)
/*
* rdtgroup_default.flags is empty so
* rdtgroup_kn_lock_live() returns
* &rdtgroup_default
*/
md = of->kn->priv;
/* md points to freed mon_data */
Set RDT_DELETED for the default group unconditionally since the flag does
not lead to the freeing of this statically allocated group.
Do not allow a new resctrl mount if there are any waiters on default group
of previous mount. A new mount will re-initialize the default group that
would appear to waiters from previous mount as though the default group is
accessible causing them to access the mon_data structures from the previous
mount that have been removed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 6.16版本存在安全漏洞，该漏洞源于fs/resctrl在卸载过程中未设置RDT_DELETED标志，导致并发读取器访问已释放的文件私有数据，可能引发释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-72080
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72080
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-72080 (3)
Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total
| CVE-2026-74475 | 10.0 CRITICAL | vxlan: use neigh_ha_snapshot() in route_shortcircuit() |
| CVE-2026-74279 | 10.0 CRITICAL | crypto: cavium/cpt - fix DMA cleanup using wrong loop index |
| CVE-2026-74280 | 10.0 CRITICAL | crypto: marvell/octeontx - fix DMA cleanup using wrong loop index |
| CVE-2026-74309 | 10.0 CRITICAL | vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler |
| CVE-2026-72421 | 10.0 CRITICAL | ipv4: fib: Don't ignore error route in local/main tables. |
| CVE-2026-72407 | 10.0 CRITICAL | geneve: validate inner network offset in geneve_gro_complete() |
| CVE-2026-72408 | 10.0 CRITICAL | geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint |
| CVE-2026-72493 | 9.9 CRITICAL | net: serialize netif_running() check in enqueue_to_backlog() |
| CVE-2026-72206 | 9.8 CRITICAL | ntfs: validate index block header more strictly |
| CVE-2026-72065 | 9.8 CRITICAL | net: mana: Validate the packet length reported by the NIC |
| CVE-2026-72129 | 9.8 CRITICAL | nvmet-rdma: handle inline data with a nonzero offset |
| CVE-2026-72130 | 9.8 CRITICAL | nvmet-auth: reject short AUTH_RECEIVE buffers |
| CVE-2026-72429 | 9.8 CRITICAL | ipv6: ioam: fix type confusion of dst_entry |
| CVE-2026-72436 | 9.8 CRITICAL | netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types |
| CVE-2026-72319 | 9.8 CRITICAL | ipvs: ensure inner headers in ICMP errors are in headroom |
| CVE-2026-72317 | 9.8 CRITICAL | SUNRPC: pin upper rpc_clnt across the TLS connect_worker |
| CVE-2026-74427 | 9.8 CRITICAL | afs: Fix netns teardown to cancel the preallocation charger |
| CVE-2026-72137 | 9.8 CRITICAL | xfrm: nat_keepalive: avoid double free on send error |
| CVE-2026-74428 | 9.8 CRITICAL | rxrpc: Fix double unlock in rxrpc_recvmsg() |
| CVE-2026-74376 | 9.8 CRITICAL | md/raid10: reset read_slot when reusing r10bio for discard |
Showing top 20 of 844 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99999
ipv4: validate checksum_start before completing checksum -
CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period -
CVE-2026-98431
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular depe -
CVE-2026-98430
RDMA/efa: Keep admin queues alive while IRQ is registered -
CVE-2026-98429
RDMA/efa: Keep EQ resources alive while IRQ is registered
Same vendor: Linux
-
CVE-2026-99999
ipv4: validate checksum_start before completing checksum -
CVE-2026-98432
ipv4: free inet_opt and ireq_opt after an RCU grace period -
CVE-2026-98431
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular depe -
CVE-2026-98430
RDMA/efa: Keep admin queues alive while IRQ is registered -
CVE-2026-98429
RDMA/efa: Keep EQ resources alive while IRQ is registered
V. Comments for CVE-2026-72080
No comments yet