HIGH Introduced in 3.16
kprobes Blacklist UAF
CVE-2026-89988
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: kprobes: Protect kprobe_blacklist with RCU __within_kprobe_blacklist() traverses kprobe_blacklist without holding kprobe_mutex. When a module is unloaded, kprobe_remove_area_blacklist() removes blacklist entries and immediately frees them with kfree(). A concurrent call to within_kprobe_blacklist() can therefore dereference freed memory. Furthermore, within_kprobe_blacklist() can be called in atomic or non-preemptible contexts where the sleeping kprobe_mutex cannot be taken. Protect kprobe_blacklist with RCU. Use guard(rcu)() and list_for_each_entry_rcu() for traversal, list_add_tail_rcu() for insertions, list_del_rcu() for deletions, and kfree_rcu() to reclaim entries safely after a grace period.
02KernelScan AI Analysis
Risk summary
A race condition in the kprobes blacklist allows a concurrent module unload to free blacklist entries while another thread is traversing the list, resulting in a use-after-free. Exploitation requires high privileges (CAP_SYS_ADMIN and CAP_SYS_MODULE in the init namespace) and winning a narrow timing window. Successful exploitation could lead to kernel memory corruption, potentially causing a panic or arbitrary code execution in kernel context.
Vulnerability analysis
The kprobe blacklist is a linked list of address ranges where kprobe registration is prohibited. When a kernel module is unloaded, its blacklist entries are removed from the list and immediately freed. However, the function that checks whether an address falls within the blacklist traverses the list without holding any lock, so a concurrent module unload can free entries that are still being referenced, causing a use-after-free. The fix protects the entire list with RCU: traversal uses RCU-protected iteration, insertions and deletions use RCU list operations, and freed entries are only reclaimed after an RCU grace period completes. Both sides of the race require elevated privileges — kprobe registration needs CAP_SYS_ADMIN and module unload needs CAP_SYS_MODULE, both in the init namespace — so this is reachable only by a privileged local attacker.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 3.16 | 6.1.188 | 8f406205003f |
| 6.12 | 3.16 | 6.12.110 | 518d9b5568bb |
| 6.18 | 3.16 | 6.18.51 | 5da247e4d1e8 |
| 6.6 | 3.16 | 6.6.157 | 630ed8734a02 |
| 7.2 | 3.16 | 7.2.5 | 6e62cf983a2b |
| mainline | 3.16 | 7.3 | 0c4256196b3a |
| cip/6.1 | 3.16 | 6.1.189-cip61 | 8f406205003f |
| cip/6.1-rt | 3.16 | 6.1.189-cip61-rt32 | 8f406205003f |
| cip/6.12 | 3.16 | 6.12.111-cip32 | 518d9b5568bb |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |