CVE-2026-72069: In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rt_
Summary
A vulnerability in the Linux kernel's real-time spinlock code allowed a use-after-free (UAF, accessing memory after it has been freed) because rt_spin_unlock() was releasing RCU protection (a mechanism that prevents memory from being freed during critical sections) too early. The fix moves the rcu_read_unlock() call to happen after the unlock operation completes, matching how regular spinlocks protect memory and preventing the window where freed memory could be accessed.
Solution / Mitigation
Move the rcu_read_unlock() invocation past the unlock operations in rt_spin_unlock() to match non-RT semantics. The migrate_enable() call remains before the unlock operation. This change applies to both spinlock and rwlock (reader-writer lock) substitutions.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72069
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%