Executive brief
A vulnerability in the Linux kernel's kprobes component can cause a complete system crash (kernel panic) when loading or unloading kernel modules. This occurs specifically after the system's internal tracing mechanism (ftrace) has encountered an error and shut down. An attacker with local access could exploit this to cause a denial-of-service, disrupting operations and potentially leading to data loss from an unscheduled reboot.
Technical details
A vulnerability exists in the Linux kernel kprobes component due to improper handling of the 'kprobe_ftrace_disabled' flag. When ftrace is killed due to internal errors, the flag is set, but the kprobes module callback does not verify this state before attempting ftrace-related operations during module insertion or removal. This leads to a NULL pointer dereference (page fault) in 'kprobes_module_callback' or '__disarm_kprobe_ftrace'. A local user with the ability to load or unload modules can trigger this crash. The fix involves adding a check for 'kprobe_ftrace_disabled' in '__disarm_kprobe_ftrace' to skip operations if ftrace is already inactive.
Affected products
- Linux Linux Kernel 3.7 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-13: patched: Initial patch authored by Masami Hiramatsu
- 2026-05-08: disclosed: CVE published by kernel.org
- 2026-05-21: advisory: NVD enrichment and analysis completed
References
- https://git.kernel.org/stable/c/8b6767e4141b2a42745b544d4555cf1614ba1a2d
- https://git.kernel.org/stable/c/9edc79d664832a842012ad105b1521c1a3c35ab3
- https://git.kernel.org/stable/c/b0ca81616a010807e91fc31db9be242b96326adc
- https://git.kernel.org/stable/c/cae928e3178c75602c21d67e21255d73e7e9ed4f
- https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261