Executive brief
The Linux kernel's event tracing subsystem can crash during boot-time self-tests if kernel thread creation fails under memory pressure. The vulnerable code unconditionally passes the result of kthread_run() to kthread_stop() without checking for errors, causing a null pointer dereference when memory allocation fails. This can result in kernel crashes during system boot.
Technical details
A logic error in kernel/trace/trace_events.c's event_test_stuff() function fails to validate the return value of kthread_run() before passing it to kthread_stop(). The kthread_run() function returns an error pointer (ERR_PTR) on failure, such as ERR_PTR(-ENOMEM) under memory pressure. When kthread_stop() dereferences this invalid pointer, the kernel crashes. The fix adds an IS_ERR() check with WARN_ON() to detect and skip the kthread_stop() call if thread creation fails. This is a local issue triggered during boot-time event self-tests, particularly under memory-constrained conditions.
Affected products
- Linux Linux kernel multiple versions (patched in stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Fix committed upstream