CVE-2026-89750

The Linux kernel's user_events tracing subsystem contains a use-after-free caused by faulty reference handling during fork: dup_task_struct() copies the parent's user_event_mm pointer into the child without taking a reference, and if user_event_mm_alloc() fails inside user_event_mm_dup(), that stale pointer is left in place. When the child later exits, user_event_mm_remove() decrements a reference the child never owned, prematurely freeing the structure while the parent still holds a pointer to it — KASAN flags this as a slab-use-after-free write in current_user_event_mm reached via the user_events ioctl path. A local low-privileged attacker who can fork and invoke the user_events ioctl interface could turn this freed-then-reused kernel memory into memory corruption and potentially kernel-level code execution, with high confidentiality, integrity, and availability impact (CVSS 3.1: 7.8, local vector). Systems running kernels built with the user_events tracing code and exposed to untrusted local users are affected; the fix simply clears the copied pointer before any possible failure so a failed fork leaves the child with nothing to free. No public proof of concept is known and the CVE is not in CISA's KEV catalog, so exploitation status is none known.

What to do: Apply distribution kernel updates as soon as they backport the upstream fix (clearing the copied user_event_mm pointer in user_event_mm_dup before any possible failure), treating this as a local privilege-escalation risk. As an interim mitigation, restrict access to tracefs and the user_events_status/ioctl interface (limit tracing-group membership and mount permissions) and limit untrusted local shell and container access. Monitor kernel logs for KASAN slab-use-after-free reports referencing current_user_event_mm as an indicator of attempted triggering.