CVE-2026-90002

CVE CVE-2026-90002EUVD EUVD-2026-80610Published 2026-09-16T10:33:12.000ZLast changed 2026-09-16T14:41:18.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->private pointer to get a reference to the trace_array and then take its reference. The problem is that the ftrace_ops itself could be freed. If the rmdir on the instance happens at the same time the set_ftrace_filter file is opened, the rmdir could have also freed the ftrace_ops and referencing it will cause a use-after-free bug and crash the kernel. Instead, pass in the trace_array as the file private data (NULL for the top level instance), and then pass both the trace_array and the ftrace_ops to the ftrace_regex_open() function. If the trace_array is NULL, then it just uses the ftrace_ops without the need to take its reference (like normal). If the ftrace_ops is NULL, that is only the case for the top level instance and the global_ops can be used. This allows the trace_array to have its reference incremented before touching the ftrace_ops that could also be freed when the instance is.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 3.15; patch: 7.3-rc2; patch: 7.2.5; 591dffdade9f07692a7dd3ed16830ec24e901ece <83fd7eca5ab0d3ac3f23bff889175d847e21af06; patch: 0; 591dffdade9f07692a7dd3ed16830ec24e901ece <9100191e5acb2e5ea2313f436667bb5fce129f47; 591dffdade9f07692a7dd3ed16830ec24e901ece <cee8f286794df916553d8d445eac5c323ec5b0f8; patch: 6.18.52

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.