{
  "threat_severity" : "Moderate",
  "public_date" : "2026-08-15T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()",
    "id" : "2516248",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2516248"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\nrt_spin_unlock() releases the RCU protection before unlocking the\nlock. That opens the door for the following UAF scenario:\nT1T2\nspin_lock(&p->lock);rcu_read_lock();\ninvalidate(p);p = rcu_dereference(ptr);\nrcu_assign_pointer(ptr, NULL);if (!p) return;\nspin_unlock(&p->lock);spin_lock(&p->lock)\nlock(&lock->lock);\nrcu_read_lock();\nkfree_rcu(p);rcu_read_unlock();\n....\nspin_unlock(&p->lock)\nrcu_read_unlock(); // Ends grace period\nrcu_do_batch()\nkfree(p);\nUAF ->  rt_mutex_cmpxchg_release(&lock->lock...)\nRegular spinlocks keep preemption disabled accross the unlock operation,\nwhich provides full RCU protection, but the RT substitution fails to\nresemble that. Same applies for the rwlock substitution.\nMove the rcu_read_unlock() invocation past the unlock operations to match\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\nthat's harmless as the caller needs to hold RCU read lock across the lock\noperation. The migrate_enable() call stays before the unlock operation\nbecause there is no per CPU operation in the unlock path which would\nrequire migration to be kept disabled.", "A flaw was found in the Linux kernel. The `rt_spin_unlock()` function, and similar real-time (RT) locking mechanisms, incorrectly release Read-Copy-Update (RCU) protection before fully unlocking, leading to a Use-After-Free (UAF) vulnerability. This issue could allow a local attacker to potentially cause a denial of service or achieve privilege escalation." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:61887",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.50.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-09-04T00:00:00Z",
    "advisory" : "RHSA-2026:63129",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.44.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-09-04T00:00:00Z",
    "advisory" : "RHSA-2026:63129",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.44.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-72069\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72069\nhttps://lore.kernel.org/linux-cve-announce/2026081519-CVE-2026-72069-dde8@gregkh/T" ],
  "name" : "CVE-2026-72069",
  "csaw" : false
}