Executive brief
A sample module included with the Linux kernel fails to properly validate the creation of a worker thread, allowing invalid memory to be passed to a cleanup function during module unload. This can cause the kernel to crash when the module is removed, resulting in a denial of service.
Technical details
The vulnerability is a missing error-check in the ftrace-direct-multi-modify sample module. Specifically, ftrace_direct_multi_init() calls kthread_run() without checking if it returns an error pointer (ERR_PTR). When kthread_run() fails due to memory exhaustion, it returns ERR_PTR(-ENOMEM), but the module incorrectly initializes and returns 0. On module unload, ftrace_direct_multi_exit() then passes this error pointer to kthread_stop(), leading to a null-pointer dereference. The fix adds an IS_ERR() check after kthread_run() and properly unregisters and propagates the error on failure. This is a sample/test code issue; production systems are impacted only if the sample module is explicitly loaded.
Affected products
- Linux Linux kernel affected versions in samples/ftrace module; patched in commit 6727b7618f49401acf373fa3ec5712e2ec52e5cf
Timeline
- 2026-09-17: disclosed: CVE-2026-90066 published
- 2026-08-26: patched: Upstream commit 6727b7618f49401acf373fa3ec5712e2ec52e5cf