CVE-2026-43409 Overview
CVE-2026-43409 is a Linux kernel vulnerability in the kprobes subsystem. The kernel crashes when modules containing kprobe probes are unloaded after ftrace has been killed by a prior error. The flaw resides in kprobes_module_callback(), which fails to honor the kprobe_ftrace_disabled flag set by ftrace_kill(). When rmmod or insmod triggers the module notifier chain, the kernel attempts ftrace operations on a disabled subsystem and dereferences invalid memory, producing an unhandled page fault.
Critical Impact
Local users with module load/unload privileges can trigger a kernel crash (denial of service) after ftrace has entered a killed state.
Affected Products
- Linux kernel (upstream stable branches prior to fixed commits)
- Distributions shipping kernels with CONFIG_KPROBES and CONFIG_KPROBES_ON_FTRACE enabled
- Systems running out-of-tree kernel modules that register kprobes
Discovery Timeline
- 2026-05-08 - CVE-2026-43409 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43409
Vulnerability Analysis
The defect is a kernel [Null Pointer Dereference / invalid memory access] in the kprobes module callback path. When ftrace_kill() runs in response to a critical ftrace error, it sets the kprobe_ftrace_disabled flag to indicate that ftrace operations must no longer be performed. The function kprobes_module_callback() is registered on the module notifier chain and invokes __disarm_kprobe_ftrace() during module teardown. Because that path does not check kprobe_ftrace_disabled, it proceeds to manipulate ftrace structures that are no longer valid.
The resulting kernel oops shows a page fault at kprobes_module_callback+0x89/0x790, reached through blocking_notifier_call_chain from __do_sys_delete_module. The faulting address fffffbfff805000d reflects a KASAN shadow lookup against a stale or freed kprobe descriptor.
Root Cause
The root cause is missing state validation. __disarm_kprobe_ftrace() does not consult kprobe_ftrace_disabled before issuing ftrace API calls. Once ftrace has been killed, its internal tables are no longer guaranteed to be consistent, so any subsequent kprobe-on-ftrace disarm operation triggered by module removal corrupts execution flow.
Attack Vector
Exploitation requires local privileges sufficient to load or unload kernel modules (typically CAP_SYS_MODULE). An attacker who can induce or wait for an ftrace failure can then run rmmod against a module that registered a kprobe-on-ftrace probe, causing an immediate kernel crash. The impact is denial of service on the affected host. No remote attack vector or memory disclosure is documented.
The vulnerability is described in upstream commits referenced in the Kernel Git Commit E113F0B and related stable backports.
Detection Methods for CVE-2026-43409
Indicators of Compromise
- Kernel oops messages referencing kprobes_module_callback+0x89 in dmesg or /var/log/kern.log
- Page fault entries with faulting RIP inside kprobes_module_callback reached via blocking_notifier_call_chain and __do_sys_delete_module
- Prior kernel warnings from ftrace_kill() indicating ftrace has been disabled
Detection Strategies
- Monitor kernel ring buffer for Oops entries correlated with rmmod or insmod invocations on modules that register kprobes
- Audit CONFIG_KPROBES_ON_FTRACE usage and inventory third-party modules registering kprobes on ftrace targets
- Compare running kernel commit hashes against the fixed commits to confirm patch status
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on kprobes_module_callback stack traces
- Track module load and unload events using auditd rules on the delete_module and init_module syscalls
- Alert on any occurrence of ftrace_kill messages in kernel logs, since these precede the exploitable condition
How to Mitigate CVE-2026-43409
Immediate Actions Required
- Apply the upstream stable kernel update containing the fix and reboot affected hosts
- Restrict module loading and unloading to trusted administrators by enforcing CAP_SYS_MODULE boundaries
- Inventory and update out-of-tree modules that register kprobes on ftrace to ensure they are rebuilt against patched kernel headers
Patch Information
The fix adds a kprobe_ftrace_disabled check in __disarm_kprobe_ftrace() so the function skips ftrace operations when ftrace has been killed. Patches are available across multiple stable branches: Kernel Git Commit C8B6767, Kernel Git Commit 9EDC79D, Kernel Git Commit B0CA816, Kernel Git Commit CAE928E, and Kernel Git Commit E113F0B.
Workarounds
- Disable CONFIG_KPROBES_ON_FTRACE in custom kernel builds where kprobe-on-ftrace functionality is not required
- Avoid removing modules that register kprobes after any ftrace error message has been logged; reboot to a clean state instead
- Enable kernel lockdown or signed-module enforcement to limit which modules can register kprobes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
