CVE-2026-90002: Linux Kernel ftrace Use-After-Free Vulnerability

CVE-2026-90002 Overview

CVE-2026-90002 is a use-after-free vulnerability in the Linux kernel ftrace subsystem. The flaw exists in the handling of the set_ftrace_filter and set_ftrace_notrace files within trace instances. A race condition occurs when these files are opened concurrently with an rmdir operation on the same trace instance. The ftrace_ops structure can be freed while another thread accesses it through the inode->private pointer, leading to a use-after-free condition and kernel crash. Local attackers with the ability to manipulate trace instances can trigger this race, causing system instability or potential privilege escalation.

Critical Impact
A local attacker can trigger a kernel use-after-free by racing open() on trace filter files against rmdir() on the trace instance, crashing the kernel or corrupting kernel memory.

Affected Products

Linux kernel versions containing the vulnerable ftrace trace instance implementation
Distributions shipping kernels prior to commits 83fd7eca, 9100191e, and cee8f286
Systems where tracefs is mounted and accessible to non-root users through group permissions

Discovery Timeline

2026-09-16 - CVE-2026-90002 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90002

Vulnerability Analysis

The Linux kernel ftrace subsystem exposes per-instance control files under tracefs, including set_ftrace_filter and set_ftrace_notrace. These files were updated to operate on specific trace_array instances rather than the global instance. The update introduced a narrow race window during file open() handling.

When a process opens one of these files, the kernel dereferences inode->private to retrieve a pointer to the ftrace_ops structure. It then walks back to the owning trace_array and increments its reference count. If another thread issues rmdir on the trace instance during this window, the instance teardown path can free the ftrace_ops before the opener acquires its reference.

Root Cause

The root cause is an ordering flaw in reference acquisition. The code takes the trace_array reference through the ftrace_ops pointer instead of holding a reference to the containing object first. Because instance removal frees the ftrace_ops alongside the trace_array, any dereference performed after the free path begins operates on released memory. This is a classic use-after-free rooted in a time-of-check to time-of-use race on lifetime state.

Attack Vector

Exploitation requires local access and the ability to open files under tracefs for a target trace instance. An attacker runs two concurrent operations: repeatedly opening set_ftrace_filter or set_ftrace_notrace inside an instance directory, and repeatedly removing that instance via rmdir. Winning the race causes the kernel to dereference freed memory inside ftrace_regex_open(), producing a crash or memory corruption that may be shaped into privilege escalation.

The upstream fix passes the trace_array as the file private_data (or NULL for the top-level instance) and forwards both the trace_array and ftrace_ops into ftrace_regex_open(). The reference on the trace_array is taken before touching ftrace_ops, closing the race window.

Detection Methods for CVE-2026-90002

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ftrace_regex_open, set_ftrace_filter, or set_ftrace_notrace in dmesg or /var/log/kern.log
KASAN reports indicating use-after-free reads on ftrace_ops structures
Repeated mkdir and rmdir operations under /sys/kernel/tracing/instances/ from non-administrative processes
Concurrent open() calls on trace instance control files from unprivileged users

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free access on ftrace_ops
Audit process activity that iterates trace instances rapidly, which is atypical for normal workloads
Correlate kernel crash telemetry with process ancestry to identify local exploitation attempts
Monitor tracefs mount permissions to identify systems exposing the interface to non-root users

Monitoring Recommendations

Collect kernel crash dumps and stack traces centrally for triage against ftrace call paths
Alert on non-root process activity touching /sys/kernel/tracing/instances/*/set_ftrace_filter
Track kernel version inventory to identify hosts still running unpatched builds
Log unexpected rmdir operations against tracing instances by unprivileged UIDs

How to Mitigate CVE-2026-90002

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 83fd7eca, 9100191e, and cee8f286 from your distribution vendor
Restrict tracefs access to root only by verifying mount options and directory permissions on /sys/kernel/tracing
Prioritize patching multi-tenant hosts and systems where local user access is untrusted
Reboot systems after applying the updated kernel to ensure the vulnerable code path is replaced

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Reference commits: Kernel Git Commit 83fd7eca, Kernel Git Commit 9100191e, and Kernel Git Commit cee8f286. The patches restructure ftrace_regex_open() to accept the trace_array directly and acquire its reference before touching ftrace_ops.

Workarounds

Unmount tracefs on systems that do not require kernel tracing: umount /sys/kernel/tracing
Remove group and other permissions from /sys/kernel/tracing so only root can access trace instance files
Disable creation of custom trace instances by non-root users via strict filesystem ACLs
Use mandatory access control policies such as SELinux or AppArmor to block unprivileged access to tracing paths

bash

# Configuration example
# Restrict tracefs to root only
chmod 700 /sys/kernel/tracing
chown root:root /sys/kernel/tracing

# Verify installed kernel includes the fix
uname -r
rpm -q --changelog kernel | grep -i "ftrace_regex_open\|trace_array reference"