Kernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
A use-after-free in the Linux kernel's user_events tracing code has been patched after it was shown to free shared state still referenced by a parent process.
User events let user space register and enable custom tracepoints. On fork, the kernel copies the parent's tracing memory context into the child, then tries to duplicate it properly. If that allocation fails, the child retained the parent's pointer without owning a reference. When the child exited, cleanup dropped a reference it never held, freeing the structure while the parent still used it. KASAN caught the resulting slab use-after-free on a later ioctl.
Jérémy Jean fixed the bug by clearing the inherited pointer before duplication begins, so a failed alloc leaves the child with nothing to free. Tracing maintainer Steven Rostedt steered the change into the duplication helper and simplified it for stable trees. The flaw dates to the remote-write enablement work for user events and is marked for backport.