CVE-2026-72069

Critical

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() rt_spin_unlock() releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spin_lock(&p->lock); rcu_read_lock(); invalidate(p); p = rcu_dereference(ptr); rcu_assign_pointer(ptr, NULL); if (!p) return; spin_unlock(&p->lock); spin_lock(&p->lock) lock(&lock->lock); rcu_read_lock(); kfree_rcu(p); rcu_read_unlock(); .... spin_unlock(&p->lock) rcu_read_unlock(); // Ends grace period rcu_do_batch() kfree(p); UAF -> rt_mutex_cmpxchg_release(&lock->lock...) Regular spinlocks keep preemption disabled accross the unlock operation, which provides full RCU protection, but the RT substitution fails to resemble that. Same applies for the rwlock substitution. Move the rcu_read_unlock() invocation past the unlock operations to match the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but that's harmless as the caller needs to hold RCU read lock across the lock operation. The migrate_enable() call stays before the unlock operation because there is no per CPU operation in the unlock path which would require migration to be kept disabled.

Package Linux Kernel
Published 2026-08-15
Last modified 2026-08-23
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

9.8

out of 10
Critical
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 5.15 and later are affected. Fixed in 5.15.217, 6.1.184, 6.6.148, 6.12.101, 6.18.40, 7.1.5, 7.2 and their respective stable series.

Affected from
≥ 5.15
Fixed in
✓ 5.15.217 5.15.x ✓ 6.1.184 6.1.x ✓ 6.6.148 6.6.x ✓ 6.12.101 6.12.x ✓ 6.18.40 6.18.x ✓ 7.1.5 7.1.x ✓ 7.2

References

7 total
Showing 5 of 7 references View all on NVD

Frequently asked questions

  • What is CVE-2026-72069?

    CVE-2026-72069 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.8 out of 10 . It affects Linux kernel versions from 5.15 onward and has been patched in 5.15.217, 6.1.184, 6.6.148 and others. CVE-2026-72069 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-72069?

    CVE-2026-72069 has a CVSS score of 9.8 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H .

  • Is there a patch available for CVE-2026-72069?

    Yes. CVE-2026-72069 has been patched. Fixed versions include 5.15.217, 6.1.184, 6.6.148 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-72069 actively exploited?

    No. CVE-2026-72069 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST