CVE-2026-72435

The vulnerability in CVE-2026-72435 stems from a straightforward ordering violation: rcu_assign_pointer() was called after kfree_rcu() in ipset's comment extension handler, reversing the required sequence. The kfree_rcu() call queues memory for release after an RCU grace period completes, but if rcu_assign_pointer() hasn't already updated the pointer, concurrent readers may access memory that is already queued for freeing — a classic use-after-free window. What makes this worth more than a one-line patch is the pattern it reveals. This ordering constraint is documented in every RCU tutorial, yet ordering violations keep appearing across kernel subsystems — not because developers are careless, but because the RCU API places the ordering invariant entirely on the caller without structural enforcement. There is no compiler guard, no type annotation, no wrapper pattern that makes 'assign-before-free' the path of least resistance. Each developer must independently remember a constraint that the language and API provide no mechanism to enforce. The ipset comment handler is particularly instructive because it's new functionality, not legacy code under maintenance pressure. The failure occurred at code review time when the feature was added, not during later modifications — suggesting that the API's fragility extends beyond cognitive load under complexity to a fundamental design gap: the correct sequence is documented but the incorrect sequence is invisible. Developers learn what to do, not what specific mistake to avoid. This suggests the fix should be two-tiered. First, correct the call order in the comment extension handler immediately. Second, audit the other ipset extension handlers for similar ordering assumptions — particularly in metadata or auxiliary features where RCU vigilance is naturally lower because the code isn't perceived as synchronization-critical. The broader question of API-level enforcement (compiler annotations, wrapper macros that bundle assign-and-free sequences) remains open, but the ipset audit is an immediate, concrete next step that this CVE's discovery makes actionable.

Reviewed through automated stages and approved by a human before publication.