CVE-2026-72071

A flaw was found in the Linux kernel's tracing/user_events component. An unprivileged local attacker can exploit a race condition during process forking within the user_event_mm_dup() function. This use-after-free vulnerability occurs when an enabler is prematurely freed while still being accessed. Successful exploitation can lead to system instability or a denial of service (DoS) due to memory corruption.

This vulnerability is rated as Moderate severity because exploitation requires local system access to interact with user-space event tracing interfaces and depends on a narrow race window during process creation, primarily causing denial of service or kernel crashes. Red Hat Enterprise Linux releases are not affected by this flaw as the vulnerable code introduced in upstream kernels is not present in supported enterprise kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.