CVE-2026-72431

In the Linux kernel, the following vulnerability has been resolved:

alloc_tag: fix use-after-free in /proc/allocinfo after module unload

allocinfostart() only reinitializes the codetag iterator at position 0. For subsequent reads (position > 0), it reuses cached iterator state from the previous batch. allocinfostop() drops mod_lock between read batches, which allows module unload to complete and free the module memory that the cached iterator still references:

CPU0 (read) CPU1 (rmmod) ---- ---- allocinfostart(pos=0) downread(modlock) allocinfoshow() ... allocinfostop() upread(modlock) codetagunloadmodule() kfree(cmod) releasemoduletags() ... freemodmem() allocinfostart(pos=N) downread(modlock) // reuses cached iter, skips re-init allocinfo_show() ct->filename <-- UAF

After freemodmem() frees the module's .rodata, allocinfo_show() dereferences ct->filename, ct->function which point there.

Save the iterator state in allocinfonext() and resume from it in allocinfostart() with codetagnextct(), which detects module removal via idr_find() returning NULL and skips to the next module.