{"id":"CVE-2026-72069","state":"PUBLISHED","title":"locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\n\nrt_spin_unlock() releases the RCU protection before unlocking the\nlock. That opens the door for the following UAF scenario:\n\n T1\t\t\t\t\tT2\n spin_lock(&p->lock);\t\trcu_read_lock();\n invalidate(p);\t\t\tp = rcu_dereference(ptr);\n rcu_assign_pointer(ptr, NULL);\tif (!p) return;\n spin_unlock(&p->lock);\t\tspin_lock(&p->lock)\n \t\t\t\t   lock(&lock->lock);\n\t\t\t\t   rcu_read_lock();\n kfree_rcu(p);\t\t\trcu_read_unlock();\n\t\t\t\t....\n\t\t\t\tspin_unlock(&p->lock)\n\t\t\t\t  rcu_read_unlock(); // Ends grace period\n rcu_do_batch()\n   kfree(p);\n\t\t\t    UAF ->\t  rt_mutex_cmpxchg_release(&lock->lock...)\n\nRegular spinlocks keep preemption disabled accross the unlock operation,\nwhich provides full RCU protection, but the RT substitution fails to\nresemble that. Same applies for the rwlock substitution.\n\nMove the rcu_read_unlock() invocation past the unlock operations to match\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\nthat's harmless as the caller needs to hold RCU read lock across the lock\noperation. The migrate_enable() call stays before the unlock operation\nbecause there is no per CPU operation in the unlock path which would\nrequire migration to be kept disabled.","publishedAt":"2026-08-15T05:52:21.752Z","updatedAt":"2026-10-19T21:19:26.463Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"af28d801cd2db4cc7378554499bd4a5d84a5517e","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"9d1fcd64ab81200e02b7a6db5eb1da8e244e8289","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"3cfaac77b3c32ac3940df28866de263c3f45d24c","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"1f0d56d3f1e88f20f6e46109402f8c15d59bac37","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"633cadbc0b8323f5cc140a285d2432089dbb534e","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"83f9fb561c1c3917e19f95523dd933c7d30291aa","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"89038cc87d80c77e7aa6f42a64b2573b74af339f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/locking/spinlock_rt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.217","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/locking/spinlock_rt.c"]}],"references":["https://git.kernel.org/stable/c/af28d801cd2db4cc7378554499bd4a5d84a5517e","https://git.kernel.org/stable/c/9d1fcd64ab81200e02b7a6db5eb1da8e244e8289","https://git.kernel.org/stable/c/3cfaac77b3c32ac3940df28866de263c3f45d24c","https://git.kernel.org/stable/c/1f0d56d3f1e88f20f6e46109402f8c15d59bac37","https://git.kernel.org/stable/c/633cadbc0b8323f5cc140a285d2432089dbb534e","https://git.kernel.org/stable/c/83f9fb561c1c3917e19f95523dd933c7d30291aa","https://git.kernel.org/stable/c/89038cc87d80c77e7aa6f42a64b2573b74af339f"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72069.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72069","state":"PUBLISHED","datePublished":"2026-08-15T05:52:21.752Z","dateUpdated":"2026-10-19T21:19:26.463Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.903Z"},"containers":{"cna":{"title":"locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\n\nrt_spin_unlock() releases the RCU protection before unlocking the\nlock. That opens the door for the following UAF scenario:\n\n T1\t\t\t\t\tT2\n spin_lock(&p->lock);\t\trcu_read_lock();\n invalidate(p);\t\t\tp = rcu_dereference(ptr);\n rcu_assign_pointer(ptr, NULL);\tif (!p) return;\n spin_unlock(&p->lock);\t\tspin_lock(&p->lock)\n \t\t\t\t   lock(&lock->lock);\n\t\t\t\t   rcu_read_lock();\n kfree_rcu(p);\t\t\trcu_read_unlock();\n\t\t\t\t....\n\t\t\t\tspin_unlock(&p->lock)\n\t\t\t\t  rcu_read_unlock(); // Ends grace period\n rcu_do_batch()\n   kfree(p);\n\t\t\t    UAF ->\t  rt_mutex_cmpxchg_release(&lock->lock...)\n\nRegular spinlocks keep preemption disabled accross the unlock operation,\nwhich provides full RCU protection, but the RT substitution fails to\nresemble that. Same applies for the rwlock substitution.\n\nMove the rcu_read_unlock() invocation past the unlock operations to match\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\nthat's harmless as the caller needs to hold RCU read lock across the lock\noperation. The migrate_enable() call stays before the unlock operation\nbecause there is no per CPU operation in the unlock path which would\nrequire migration to be kept disabled."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"af28d801cd2db4cc7378554499bd4a5d84a5517e","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"9d1fcd64ab81200e02b7a6db5eb1da8e244e8289","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"3cfaac77b3c32ac3940df28866de263c3f45d24c","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"1f0d56d3f1e88f20f6e46109402f8c15d59bac37","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"633cadbc0b8323f5cc140a285d2432089dbb534e","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"83f9fb561c1c3917e19f95523dd933c7d30291aa","versionType":"git"},{"version":"0f383b6dc96e976dfbf2721b0bf10bd96103b341","status":"affected","lessThan":"89038cc87d80c77e7aa6f42a64b2573b74af339f","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/locking/spinlock_rt.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.217","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/locking/spinlock_rt.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/af28d801cd2db4cc7378554499bd4a5d84a5517e"},{"url":"https://git.kernel.org/stable/c/9d1fcd64ab81200e02b7a6db5eb1da8e244e8289"},{"url":"https://git.kernel.org/stable/c/3cfaac77b3c32ac3940df28866de263c3f45d24c"},{"url":"https://git.kernel.org/stable/c/1f0d56d3f1e88f20f6e46109402f8c15d59bac37"},{"url":"https://git.kernel.org/stable/c/633cadbc0b8323f5cc140a285d2432089dbb534e"},{"url":"https://git.kernel.org/stable/c/83f9fb561c1c3917e19f95523dd933c7d30291aa"},{"url":"https://git.kernel.org/stable/c/89038cc87d80c77e7aa6f42a64b2573b74af339f"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:46:41.836Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72069","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:51:20.973593Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T21:19:26.463Z"}}]}}}