CVE-2026-72012 tracing/osnoise: Call synchronize_rcu() when unregistering
A race condition in the Linux kernel osnoise tracer could lead to use-after-free issues, potentially causing system crashes or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72012?
CVE-2026-72012 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing/osnoise: Call synchronize_rcu() when unregistering
This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to.
Weakness: CWE-667
Which versions are affected by CVE-2026-72012?
How do I fix CVE-2026-72012?
Apply the vendor's patch.
Is CVE-2026-72012 being exploited?
There is no known exploitation of CVE-2026-72012 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72012, DEBIAN-CVE-2026-72012, GHSA-jc7h-x8xh-33g2, UBUNTU-CVE-2026-72012.