From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEBF54F55C5 for ; Wed, 16 Sep 2026 10:43:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555417; cv=none; b=g+gJW3xqfveWrcf/ZIrLXv0NXC7ikPiqTcfJnWwoPF2GzySGk8R4oynI+rxeNqYJZlU9dqdw+kIwXuDC5ZhY4h6QltyZhnfyPiE8U7bYcpH8ML+4Q/dcJAkqDHz6FoNKnl5vUkwt087BfwmfusVd2JDt5kGWKgSt95RBEsaNafM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555417; c=relaxed/simple; bh=3gE0tDlALpwq/GCMSofKXpCI46X+jpw3t2+ILuf3o9k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pgTMkQXwO8QNDxEYAXQG8k5WeqfNqAVL20xthDjugefmWEZ1Ew1xDVaPCH8VBQZSugprVfndqH6H2MnseFm9R4BU7ALogPsDhRDJFXoTIMwgvAv8YJ/Ujt7Xl9eDfZNmt/8KgxrttZ1Q/fJCN2VnBPuLRXIahwqCgo4iudxB0sM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EA9psJ9L; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EA9psJ9L" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6715F1F0089C; Wed, 16 Sep 2026 10:43:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555398; bh=ObqP0d1NCsj9h7NmToQyLJyCQg61nSmyGz7LQZomD+g=; h=From:To:Cc:Subject:Date:Reply-To; b=EA9psJ9LZIAdIFkNUSXMJhBOKn0YUbW8gziAph4Yn516yU8Z/qseCkJER4JJ2PcGl SE+XUoIEE7XFEj4x/wdyBr3zV0zcGiHvv98OnX1L87Yecbsy5iYQOjBpJgo1q6+qXA TJuJwwJe22TytvnZ2eOkJXFpIwMi+Ec3L2r7Q5kI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90002: ftrace: Take trace_array reference before accessing its ftrace_ops Date: Wed, 16 Sep 2026 11:32:12 +0100 Message-ID: <2026091600-CVE-2026-90002-d670@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3288; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=QomtCcZeIu2cxDxmzOeGJAlOwE1G3fsI16pA1VHIH4I=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8ldsOfRndtF/qb/Pvqt+XrxS+u/MIr20FWvrtx+y7 /UI+ij8rSOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmMlOPYZ5hhvG9dOarvk6H tCxEFv69t3zuvs8Mc4U+b+NfduNqenHX3z7zXNGjhjE83AA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->private pointer to get a reference to the trace_array and then take its reference. The problem is that the ftrace_ops itself could be freed. If the rmdir on the instance happens at the same time the set_ftrace_filter file is opened, the rmdir could have also freed the ftrace_ops and referencing it will cause a use-after-free bug and crash the kernel. Instead, pass in the trace_array as the file private data (NULL for the top level instance), and then pass both the trace_array and the ftrace_ops to the ftrace_regex_open() function. If the trace_array is NULL, then it just uses the ftrace_ops without the need to take its reference (like normal). If the ftrace_ops is NULL, that is only the case for the top level instance and the global_ops can be used. This allows the trace_array to have its reference incremented before touching the ftrace_ops that could also be freed when the instance is. The Linux kernel CVE team has assigned CVE-2026-90002 to this issue. Affected and fixed versions =========================== Issue introduced in 3.15 with commit 591dffdade9f07692a7dd3ed16830ec24e901ece and fixed in 6.18.52 with commit 83fd7eca5ab0d3ac3f23bff889175d847e21af06 Issue introduced in 3.15 with commit 591dffdade9f07692a7dd3ed16830ec24e901ece and fixed in 7.2.5 with commit cee8f286794df916553d8d445eac5c323ec5b0f8 Issue introduced in 3.15 with commit 591dffdade9f07692a7dd3ed16830ec24e901ece and fixed in 7.3-rc2 with commit 9100191e5acb2e5ea2313f436667bb5fce129f47 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90002 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/ftrace.h kernel/trace/ftrace.c kernel/trace/trace.h kernel/trace/trace_functions.c kernel/trace/trace_stack.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/83fd7eca5ab0d3ac3f23bff889175d847e21af06 https://git.kernel.org/stable/c/cee8f286794df916553d8d445eac5c323ec5b0f8 https://git.kernel.org/stable/c/9100191e5acb2e5ea2313f436667bb5fce129f47