# CVE-2026-72431: linux: In the Linux kernel, the following vulnerability has been resolved:  alloc_tag: fix use-after-free in /proc/allocinfo...

CVE-2026-72431 is fixed in linux on 1 platform by DEBIAN-CVE-2026-72431 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-72431
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 15, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  alloc_tag: fix use-after-free in /proc/allocinfo after module unload  allocinfo_start() only reinitializes the codetag iterator at position 0.  For subsequent reads (position > 0), it reuses cached iterator state from the previous batch.  allocinfo_stop() drops mod_lock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references:    CPU0 (read)                        CPU1 (rmmod)   ----                               ----   allocinfo_start(pos=0)     down_read(mod_lock)     allocinfo_show()     ...   allocinfo_stop()     up_read(mod_lock)                                      codetag_unload_module()                                        kfree(cmod)                                        release_module_tags()                                      ...                                      free_mod_mem()   allocinfo_start(pos=N)     down_read(mod_lock)     // reuses cached iter, skips re-init   allocinfo_show()     ct->filename   <-- UAF  After free_mod_mem() frees the module's .rodata, allocinfo_show() dereferences ct->filename, ct->function which point there.  Save the iterator state in allocinfo_next() and resume from it in allocinfo_start() with codetag_next_ct(), which detects module removal via idr_find() returning NULL and skips to the next module.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-72431](https://patchblox.com/security/data/fix/linux/debian-cve-2026-72431.md) | Aug 15, 2026 |

---

Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.