Executive brief
The Linux kernel's tracing subsystem contains files that display active event filters and triggers. These files failed to prevent the underlying trace array from being freed while being read, potentially causing a system crash. An attacker or local user with access to tracing facilities could trigger this crash by deleting a trace array while another process reads these diagnostic files.
Technical details
A use-after-free vulnerability exists in the kernel/trace/trace_events.c file affecting the show_event_filters and show_event_triggers debugfs files. The vulnerable code does not acquire a reference to the trace_array structure when opening these files, allowing the trace array to be freed via "rmdir" while a task is reading one of them. The file operations iterate over events within a trace_array instance without preventing that instance from being deallocated during iteration, resulting in a crash. The fix involves calling tracing_check_open_get_tr() and trace_array_get() during file open to hold a reference until the file is closed, and modifying the release handler to properly decrement this reference via trace_array_put().
Affected products
- Linux Linux Kernel Multiple versions from linux-2.6.11.y through linux-7.2.y (exact affected range not explicitly stated in advisory)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-28: patched: Upstream patch by Steven Rostedt (commit f4a771cc684c7354b6200147f7252c58d17408ff)
- 2026-09-11: patched: Stable kernel backport merged (commit 2ee3f7d43f79efaca0cd84a6798653d9d75ce60b)