CVE-2026-72431

In the Linux kernel, the following vulnerability has been resolved:

alloc_tag: fix use-after-free in /proc/allocinfo after module unload

allocinfo_start() only reinitializes the codetag iterator at position 0.

For subsequent reads (position > 0), it reuses cached iterator state from

the previous batch. allocinfo_stop() drops mod_lock between read batches,

which allows module unload to complete and free the module memory that the

cached iterator still references:

CPU0 (read) CPU1 (rmmod)

---- ----

allocinfo_start(pos=0)

down_read(mod_lock)

allocinfo_show()

...

allocinfo_stop()

up_read(mod_lock)

codetag_unload_module()

kfree(cmod)

release_module_tags()

...

free_mod_mem()

allocinfo_start(pos=N)

down_read(mod_lock)

// reuses cached iter, skips re-init

allocinfo_show()

ct->filename <-- UAF

After free_mod_mem() frees the module's .rodata, allocinfo_show()

dereferences ct->filename, ct->function which point there.

Save the iterator state in allocinfo_next() and resume from it in

allocinfo_start() with codetag_next_ct(), which detects module removal via

idr_find() returning NULL and skips to the next module.