CVE-2026-89750

In the Linux kernel, the following vulnerability has been resolved:

tracing/user events: Clear copied tracing state before fork duplication

dup task struct() copies user event mm from the parent into the child, without grabbing a reference to it. user event mm dup() should replace it, but it leaves that copied pointer unmodified if user event mm alloc() fails.

When the child exits, user event mm remove() decrements a reference the child never owned, which ultimately frees user event mm, while the parent still as a stale pointer to it. This creates a UAF, which KASAN reports as:

BUG: KASAN: slab-use-after-free in current user event mm+0x51/0x1d0 Write of size 4 at addr ffff888005010d30 by task init/44

Call Trace: kasan report+0xce/0x100 kasan check range+0x10f/0x1e0 current user event mm+0x51/0x1d0 user events ioctl+0x82e/0x15c0 x64 sys ioctl+0x139/0x1c0 do syscall 64+0xce/0x450 entry SYSCALL 64 after hwframe+0x77/0x7f

Allocated by task 44: kasan kmalloc+0x8f/0xa0 kmalloc cache noprof+0x180/0x3a0 user event mm alloc+0x3c/0x1f0 current user event mm+0x88/0x1d0

Freed by task 42: kasan slab free+0x43/0x70 kfree+0x13a/0x390 process one work+0x696/0xf90 worker thread+0x420/0xba0

The fix simply clears the copied pointer before any possible failure. In case of failure, the child then has nothing to free.