CVE-2026-90013: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90013 Overview

CVE-2026-90013 is a use-after-free vulnerability in the Linux kernel's tracing subsystem. The flaw resides in how the kernel handles trace_array options files under the ftrace instances interface. When a task opens an options file, the kernel does not take a reference on the underlying trace_array. A second task can concurrently remove the instance, freeing the options descriptor while the first task still holds a pointer to it. The result is a kernel-space use-after-free that can trigger a crash or be leveraged for local privilege escalation.

Critical Impact
Local, low-privileged users can trigger a kernel use-after-free by racing an open of a tracing options file against removal of the corresponding ftrace instance, leading to kernel crash or potential privilege escalation.

Affected Products

Linux kernel — tracing (ftrace) subsystem
Distributions shipping vulnerable Linux kernel versions prior to the referenced stable commits
Systems exposing the tracefs options interface to unprivileged or containerized workloads

Discovery Timeline

2026-09-16 - CVE-2026-90013 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90013

Vulnerability Analysis

The Linux tracing subsystem exposes per-instance option files under tracefs. Each file corresponds to a flag in the owning trace_array. The trace_array maintains a trace_flags_index array whose element addresses are stored in inode->i_private so the file operations can resolve which flag they represent.

Because the open path reads the index element and then walks back to the trace_array descriptor without first pinning the array, the descriptor lifetime is not guaranteed for the duration of the file operation. If another task removes the tracing instance, the descriptor and its trace_flags_index are freed while the opener still dereferences them. This is a classic use-after-free triggered through a race in reference-counting logic.

The upstream fix introduces trace_array_options_get(), which walks the ftrace_trace_arrays list under trace_types_lock, compares the passed i_private address against each array's trace_flags_index, and increments the matching trace_array reference before the file handle is used.

Root Cause

The root cause is missing reference acquisition on trace_array at options-file open time. The open handler dereferences an index element derived from inode->i_private without holding a reference to the parent object, violating the object lifetime rules enforced elsewhere in the tracing subsystem.

Attack Vector

Exploitation requires local access with permission to open tracefs options files and to create or remove tracing instances. An attacker races two threads: one opens an options file such as /sys/kernel/tracing/instances/<name>/options/<flag>, while the other removes the <name> instance via rmdir. Winning the race causes the kernel to operate on freed memory.

See the upstream fixes for implementation detail: kernel.org commit 64a41f4a, kernel.org commit d0f37d77, and kernel.org commit f2951ebd.

Detection Methods for CVE-2026-90013

Indicators of Compromise

Kernel oops or panic referencing tracing symbols such as trace_array, trace_flags_index, or options file operations in the backtrace.
KASAN reports flagging use-after-free reads or writes inside the ftrace instance teardown path.
Unexpected process crashes or system instability correlated with workloads that manipulate /sys/kernel/tracing/instances/.

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free access during ftrace instance churn.
Audit which local users, containers, and service accounts can write to tracefs and enumerate options files.
Monitor process behavior for unprivileged processes that repeatedly open options files while creating or removing tracing instances.

Monitoring Recommendations

Ship kernel logs (dmesg, /var/log/kern.log) to a central SIEM and alert on tracing-subsystem oops signatures.
Track syscall telemetry for openat on tracefs paths paired with rmdir on instance directories from the same user or cgroup.
Baseline expected ftrace usage on production hosts and alert on deviations from that baseline.

How to Mitigate CVE-2026-90013

Immediate Actions Required

Apply the upstream stable kernel updates that introduce trace_array_options_get() and rebuild or replace affected kernels.
Restrict tracefs access so that only trusted administrators can open options files and remove instances.
Review container runtime configurations and ensure workloads do not mount tracefs or debugfs with write access.

Patch Information

The fix adds reference acquisition on trace_array when an options file is opened. Merge the changes referenced in kernel.org commit 64a41f4a, kernel.org commit d0f37d77, and kernel.org commit f2951ebd, or upgrade to a distribution kernel that already incorporates them.

Workarounds

Unmount tracefs where it is not required, or remount it with permissions that exclude non-root users.
Drop CAP_SYS_ADMIN from containers and services that do not need kernel tracing, since instance removal requires that capability.
Use seccomp or LSM policies to block openat on /sys/kernel/tracing/instances/*/options/* for untrusted workloads until patches are deployed.

bash

# Example: restrict tracefs to root only until patched kernel is deployed
mount -o remount,mode=0700,uid=0,gid=0 /sys/kernel/tracing