Executive brief
The Linux kernel's function tracing subsystem includes a race condition in trace instance file handling that can lead to a kernel crash. When trace instance filter files (set_ftrace_filter, set_ftrace_notrace) are opened while the instance is being deleted, freed memory can be dereferenced, causing the system to crash and creating a potential denial-of-service condition for systems using kernel tracing.
Technical details
The vulnerability is a use-after-free race condition in the ftrace subsystem's handling of trace instance files. The root cause is a race window between opening set_ftrace_filter or set_ftrace_notrace files and concurrent instance removal (rmdir). When the file is opened, the code attempts to dereference ftrace_ops pointers stored in inode private data to obtain a trace_array reference; simultaneously, instance removal can free these ftrace_ops structures, leading to use-after-free. The fix restructures the code to pass trace_array pointers directly as file private data and increments trace_array references before accessing ftrace_ops, eliminating the race. No user authentication is required—any process with access to tracefs can trigger the condition. The vulnerability affects Linux kernel versions since the introduction of per-instance tracing filters and patches are available in upstream and stable kernels.
Affected products
- Linux Linux kernel 3.0 and later (affected since introduction of per-instance ftrace filters)
Timeline
- 2026-09-16: disclosed: CVE-2026-90002 published
- 2026-09-01: patched: Upstream commit 9100191e5acb2e5ea2313f436667bb5fce129f47 merged
- 2026-09-14: patched: Included in stable kernel releases via Greg Kroah-Hartman