CVE-2026-90002 (GCVE-0-2026-90002)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->private pointer to get a reference to the trace_array and then take its reference. The problem is that the ftrace_ops itself could be freed. If the rmdir on the instance happens at the same time the set_ftrace_filter file is opened, the rmdir could have also freed the ftrace_ops and referencing it will cause a use-after-free bug and crash the kernel. Instead, pass in the trace_array as the file private data (NULL for the top level instance), and then pass both the trace_array and the ftrace_ops to the ftrace_regex_open() function. If the trace_array is NULL, then it just uses the ftrace_ops without the need to take its reference (like normal). If the ftrace_ops is NULL, that is only the case for the top level instance and the global_ops can be used. This allows the trace_array to have its reference incremented before touching the ftrace_ops that could also be freed when the instance is.
References
Impacted products
Vendor Product Version
Linux Linux Version: 591dffdade9f07692a7dd3ed16830ec24e901ece
Version: 591dffdade9f07692a7dd3ed16830ec24e901ece
Version: 591dffdade9f07692a7dd3ed16830ec24e901ece
Version: 591dffdade9f07692a7dd3ed16830ec24e901ece
Version: 591dffdade9f07692a7dd3ed16830ec24e901ece
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ftrace.h",
            "kernel/trace/ftrace.c",
            "kernel/trace/trace.h",
            "kernel/trace/trace_functions.c",
            "kernel/trace/trace_stack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "29266da8ee1d9be656b1f22460c49538e1930658",
              "status": "affected",
              "version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
              "versionType": "git"
            },
            {
              "lessThan": "177cd8966325f0ffffa3c9381f9e0422019a3973",
              "status": "affected",
              "version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
              "versionType": "git"
            },
            {
              "lessThan": "83fd7eca5ab0d3ac3f23bff889175d847e21af06",
              "status": "affected",
              "version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
              "versionType": "git"
            },
            {
              "lessThan": "cee8f286794df916553d8d445eac5c323ec5b0f8",
              "status": "affected",
              "version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
              "versionType": "git"
            },
            {
              "lessThan": "9100191e5acb2e5ea2313f436667bb5fce129f47",
              "status": "affected",
              "version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ftrace.h",
            "kernel/trace/ftrace.c",
            "kernel/trace/trace.h",
            "kernel/trace/trace_functions.c",
            "kernel/trace/trace_stack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Take trace_array reference before accessing its ftrace_ops\n\nThe trace instance files set_ftrace_filter and set_ftrace_notrace was\nupdated to work with specific trace instances (trace_arrays). The issue is\nthat when these files are opened, there is a small race window where it\nwill use the ftrace_ops from the inode-\u003eprivate pointer to get a reference\nto the trace_array and then take its reference. The problem is that the\nftrace_ops itself could be freed. If the rmdir on the instance happens at\nthe same time the set_ftrace_filter file is opened, the rmdir could have\nalso freed the ftrace_ops and referencing it will cause a use-after-free\nbug and crash the kernel.\n\nInstead, pass in the trace_array as the file private data (NULL for the\ntop level instance), and then pass both the trace_array and the ftrace_ops\nto the ftrace_regex_open() function. If the trace_array is NULL, then it\njust uses the ftrace_ops without the need to take its reference (like\nnormal). If the ftrace_ops is NULL, that is only the case for the top\nlevel instance and the global_ops can be used.\n\nThis allows the trace_array to have its reference incremented before\ntouching the ftrace_ops that could also be freed when the instance is."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only by a local open() of an instance set_ftrace_filter/set_ftrace_notrace racing rmdir of that tracing instance under /sys/kernel/tracing/instances; there is no network or adjacent-protocol path into ftrace_filter_open().\nAC:L - The attacker drives both sides: mkdir an instance, open its filter file on one thread, and rmdir it on another. instance_rmdir drops inode locks and kfree()s ftrace_ops before unlinking the files, so the race is retryable with no condition outside attacker control.\nPR:L - ftrace_regex_open()/instance mkdir/rmdir check only LOCKDOWN_TRACEFS (off by default) and DAC, with no capable() call. Android/Perfetto, ChromeOS, and distro tracing-group gid= mounts routinely grant unprivileged users write on /sys/kernel/tracing/instances.\nUI:N - The attacker performs mkdir, concurrent open of set_ftrace_filter/set_ftrace_notrace, and rmdir entirely from their own threads; no victim mount, click, or other-user action is required.\nS:U - The use-after-free is of a kmalloc\u0027d struct ftrace_ops in the host kernel heap; any privilege escalation stays within the kernel\u0027s own security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of heap-allocated ftrace_ops: open() reads ops-\u003eprivate, ops-\u003eflags, and ops-\u003efunc_hash from the freed object, so after slab reclaim/spray those fields become attacker-controlled and yield an arbitrary kernel read.\nI:H - ftrace_ops_init() writes flags, func_hash, and a mutex into the freed object and later mutex_lock()s ops-\u003efunc_hash-\u003eregex_lock; with spray this is an arbitrary-write primitive, and ftrace_ops also carries hijackable function pointers (func, ops_func).\nA:H - Dereferencing the freed ftrace_ops (ops-\u003eprivate, flags, func_hash) on the open-versus-rmdir race reliably oopses or panics the kernel, as described in the fix, and can be re-triggered by repeating instance create/open/rmdir."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:49:23.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/29266da8ee1d9be656b1f22460c49538e1930658"
        },
        {
          "url": "https://git.kernel.org/stable/c/177cd8966325f0ffffa3c9381f9e0422019a3973"
        },
        {
          "url": "https://git.kernel.org/stable/c/83fd7eca5ab0d3ac3f23bff889175d847e21af06"
        },
        {
          "url": "https://git.kernel.org/stable/c/cee8f286794df916553d8d445eac5c323ec5b0f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9100191e5acb2e5ea2313f436667bb5fce129f47"
        }
      ],
      "title": "ftrace: Take trace_array reference before accessing its ftrace_ops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90002",
    "datePublished": "2026-09-16T10:33:12.734Z",
    "dateReserved": "2026-09-11T19:38:34.780Z",
    "dateUpdated": "2026-10-21T12:49:23.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.