GHSA-MGQ9-4F63-HXM9
Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-23 15:32In the Linux kernel, the following vulnerability has been resolved:
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario:
T1 T2 spin_lock(&p->lock); rcu_read_lock(); invalidate(p); p = rcu_dereference(ptr); rcu_assign_pointer(ptr, NULL); if (!p) return; spin_unlock(&p->lock); spin_lock(&p->lock) lock(&lock->lock); rcu_read_lock(); kfree_rcu(p); rcu_read_unlock(); .... spin_unlock(&p->lock) rcu_read_unlock(); // Ends grace period rcu_do_batch() kfree(p); UAF -> rt_mutex_cmpxchg_release(&lock->lock...)
Regular spinlocks keep preemption disabled accross the unlock operation, which provides full RCU protection, but the RT substitution fails to resemble that. Same applies for the rwlock substitution.
Move the rcu_read_unlock() invocation past the unlock operations to match the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but that's harmless as the caller needs to hold RCU read lock across the lock operation. The migrate_enable() call stays before the unlock operation because there is no per CPU operation in the unlock path which would require migration to be kept disabled.
{
"affected": [],
"aliases": [
"CVE-2026-72069"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T06:21:16Z",
"severity": "CRITICAL"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\n\nrt_spin_unlock() releases the RCU protection before unlocking the\nlock. That opens the door for the following UAF scenario:\n\n T1\t\t\t\t\tT2\n spin_lock(\u0026p-\u003elock);\t\trcu_read_lock();\n invalidate(p);\t\t\tp = rcu_dereference(ptr);\n rcu_assign_pointer(ptr, NULL);\tif (!p) return;\n spin_unlock(\u0026p-\u003elock);\t\tspin_lock(\u0026p-\u003elock)\n \t\t\t\t lock(\u0026lock-\u003elock);\n\t\t\t\t rcu_read_lock();\n kfree_rcu(p);\t\t\trcu_read_unlock();\n\t\t\t\t....\n\t\t\t\tspin_unlock(\u0026p-\u003elock)\n\t\t\t\t rcu_read_unlock(); // Ends grace period\n rcu_do_batch()\n kfree(p);\n\t\t\t UAF -\u003e\t rt_mutex_cmpxchg_release(\u0026lock-\u003elock...)\n\nRegular spinlocks keep preemption disabled accross the unlock operation,\nwhich provides full RCU protection, but the RT substitution fails to\nresemble that. Same applies for the rwlock substitution.\n\nMove the rcu_read_unlock() invocation past the unlock operations to match\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\nthat\u0027s harmless as the caller needs to hold RCU read lock across the lock\noperation. The migrate_enable() call stays before the unlock operation\nbecause there is no per CPU operation in the unlock path which would\nrequire migration to be kept disabled.",
"id": "GHSA-mgq9-4f63-hxm9",
"modified": "2026-08-23T15:32:59Z",
"published": "2026-08-15T06:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72069"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1f0d56d3f1e88f20f6e46109402f8c15d59bac37"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3cfaac77b3c32ac3940df28866de263c3f45d24c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/633cadbc0b8323f5cc140a285d2432089dbb534e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/83f9fb561c1c3917e19f95523dd933c7d30291aa"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89038cc87d80c77e7aa6f42a64b2573b74af339f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9d1fcd64ab81200e02b7a6db5eb1da8e244e8289"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/af28d801cd2db4cc7378554499bd4a5d84a5517e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.