{"apiVersion":"1.0","identifier":"CVE-2026-72431","description":"In the Linux kernel, the following vulnerability has been resolved: alloc_tag: fix use-after-free in /proc/allocinfo after module unload allocinfo_start() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfo_stop() drops mod_lock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references: CPU0 (read) CPU1 (rmmod) ---- ---- allocinfo_start(pos=0) down_read(mod_lock) allocinfo_show() ... allocinfo_stop() up_read(mod_lock) codetag_unload_module() kfree(cmod) release_module_tags() ... free_mod_mem() allocinfo_start(pos=N) down_read(mod_lock) // reuses cached iter, skips re-init allocinfo_show() ct->filename <-- UAF After free_mod_mem() frees the module-s .rodata, allocinfo_show() dereferences ct->filename, ct->function which point there. Save the iterator state in allocinfo_next() and resume from it in allocinfo_start() with codetag_next_ct(), which detects module removal via idr_find() returning NULL and skips to the next module.","publishedAt":"2026-08-15T06:22:16","lastModifiedAt":"2026-08-17T06:19:10","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72431","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00198,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72431","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72431","en":"https://www.redsauce.net/en/cves/CVE-2026-72431","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72431","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72431","de":"https://www.redsauce.net/de/cves/CVE-2026-72431","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72431","el":"https://www.redsauce.net/el/cves/CVE-2026-72431"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72431"}}