Executive brief
The Linux kernel's kprobes feature (used for dynamic kernel instrumentation and tracing) had a race condition in its blacklist management. When kernel modules are unloaded, blacklist entries were freed without proper synchronization, allowing concurrent code to dereference freed memory. This could lead to kernel crashes or potential code execution with kernel privileges.
Technical details
The vulnerability is a use-after-free race condition in the kprobes subsystem. The __within_kprobe_blacklist() function traversed the kprobe_blacklist without holding the kprobe_mutex lock. Concurrently, kprobe_remove_area_blacklist() could free blacklist entries via kfree() during module unload, allowing __within_kprobe_blacklist() to dereference freed memory. Additionally, __within_kprobe_blacklist() can be called in atomic/non-preemptible contexts where acquiring the sleeping kprobe_mutex is impossible. The fix protects the blacklist with RCU synchronization: using list_for_each_entry_rcu() for traversal, list_add_tail_rcu() for insertions, list_del_rcu() for deletions, and kfree_rcu() for safe memory reclamation after a grace period.
Affected products
- Linux Linux kernel 2.6.11 and later (affected versions include 3.x, 4.x, 5.x, 6.x, 7.x)
Timeline
- 2026-09-16: disclosed
- 2026-09-03: patched: Patch committed upstream; backported to stable branches
- 2026-08-30: other: Fix authored by Masami Hiramatsu