CVE-2026-89749: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89749 Overview

CVE-2026-89749 is a Linux kernel vulnerability in the tracing subsystem. The event_test_stuff() function calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). When kernel thread creation fails under memory pressure, kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) instead of a valid task_struct. The subsequent kthread_stop() call dereferences the invalid pointer and crashes the kernel. The condition surfaces during the boot-time event self-test path in the tracing infrastructure.

Critical Impact
A kernel crash during boot-time tracing self-test denies service to the affected system when memory pressure prevents self-test thread creation.

Affected Products

Linux kernel (tracing subsystem, event_test_stuff() code path)
Stable kernel branches referenced by the fix commits 12a499f, 42ccb21, 649bc7d, 98d06fb, adadf41, c1a4fb7, c40e0b4, and ceb1707
Distributions shipping kernels with the boot-time event tracing self-test enabled

Discovery Timeline

2026-09-11 - CVE-2026-89749 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89749

Vulnerability Analysis

The defect is a null pointer dereference triggered by an unchecked error pointer [CWE-476]. Linux kernel functions that return pointers frequently encode failures using the ERR_PTR() macro, which produces a pointer in the last page of the address space. Callers are expected to test the return value with IS_ERR() before dereferencing.

Inside event_test_stuff(), the tracing self-test creates a helper thread with kthread_run(). When thread creation fails, kthread_run() returns an encoded error pointer such as ERR_PTR(-ENOMEM). The current code passes this value directly into kthread_stop(), which dereferences fields of the assumed task_struct and triggers a fault in kernel context.

The upstream fix adds a check on the return value of kthread_run() before calling kthread_stop() and emits a WARN_ON() when self-test thread creation fails. This mirrors the approach taken in the ring-buffer self-test fix in commit 91542863abad.

Root Cause

The root cause is the omission of an IS_ERR() check on the pointer returned by kthread_run(). The self-test code assumed thread creation would always succeed and treated the returned pointer as a valid task_struct handle.

Attack Vector

This is a reliability defect rather than a remotely reachable exploit. The failure path activates only when the kernel cannot allocate resources during the boot-time event tracing self-test. A local actor able to induce memory pressure at boot, or environments with constrained memory, can experience a kernel crash. There is no known remote attack vector and no public proof of concept.

The vulnerability manifests entirely in kernel-mode code executed during initialization. See the kernel commit adadf41 for the source-level fix.

Detection Methods for CVE-2026-89749

Indicators of Compromise

Kernel panic or oops messages referencing kthread_stop in the call trace during early boot
Boot-time log entries indicating tracing event self-test failure, particularly under memory pressure
Repeated boot failures on hosts with constrained memory allocations

Detection Strategies

Inventory running kernel versions across the fleet and cross-reference against the fix commits 12a499f, 42ccb215, 649bc7d, 98d06fb, adadf41, c1a4fb7, c40e0b4, and ceb1707
Query package management databases for installed kernel builds and compare against distribution advisories referencing CVE-2026-89749
Review boot logs (dmesg, journalctl -k) for WARN_ON or panic events involving event_test_stuff or kthread_stop

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on unexpected boot-time kernel warnings involving tracing subsystem symbols
Track host availability metrics to identify systems that fail to complete boot after kernel updates
Monitor memory pressure conditions on hosts running kernels that predate the fix

How to Mitigate CVE-2026-89749

Immediate Actions Required

Apply the vendor-supplied kernel updates that incorporate the upstream patches referenced by the fix commits listed above
Reboot affected hosts into the patched kernel after installation to activate the fix
Prioritize memory-constrained systems and hosts where kernel tracing self-tests execute at boot

Patch Information

The fix is upstream in the Linux kernel tracing subsystem. Relevant stable-tree commits include 12a499f741fc, 42ccb215ef0a, 649bc7df3e5d, 98d06fb9865a, adadf4192f70, c1a4fb7aa290, c40e0b4fa365, and ceb1707aef58. Consult the kernel.org stable tree and your distribution's security advisories for backported package versions.

Workarounds

Disable boot-time event tracing self-tests where the kernel build permits (for example, by removing CONFIG_EVENT_TRACE_STARTUP_TEST from custom kernel configurations)
Ensure sufficient memory is available at boot to reduce the probability of kthread_run() returning ERR_PTR(-ENOMEM)
Restrict local access on unpatched hosts to reduce the risk of induced memory-pressure conditions during boot

bash

# Example: verify running kernel and check for the fix commit in distribution changelog
uname -r
rpm -q --changelog kernel | grep -iE 'CVE-2026-89749|event_test_stuff|kthread_stop'
# Debian/Ubuntu equivalent
dpkg -s linux-image-$(uname -r) | grep -i version
apt changelog linux-image-$(uname -r) | grep -iE 'CVE-2026-89749|kthread_stop'