CVE-2026-72012

HighCVSS 7.8

Published: 15/08/2026(UTC)Updated: 23/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

In the Linux kernel's tracing/osnoise module, there is a missing synchronize_rcu() call during unregistering. This can lead to use-after-free when RCU readers are still traversing the instance list.

Risk Assessment

Use-after-free can lead to system crashes or potential privilege escalation.

Recommendation

Apply a Linux kernel update that includes the fix adding synchronize_rcu() during unregistering.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronize_rcu() when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to.