CVE-2026-90014: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90014 Overview

CVE-2026-90014 is a use-after-free vulnerability in the Linux kernel's tracing subsystem. The flaw resides in the show_event_filters and show_event_triggers files that expose filter and trigger configuration for a given trace array instance. These files iterate events within a trace_array without holding a reference to the instance. A concurrent rmdir on the instance can free the trace_array while a task is reading one of these files, causing a use-after-free crash.

Critical Impact
A local user with access to the tracefs interface can trigger a kernel use-after-free by racing file reads against instance removal, leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel versions that introduced the show_event_filters and show_event_triggers tracefs files
Upstream stable kernel branches prior to the fix commits 2ee3f7d43f79 and f4a771cc684c
Distributions shipping the affected upstream tracing code

Discovery Timeline

2026-09-16 - CVE CVE-2026-90014 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90014

Vulnerability Analysis

The Linux kernel exposes per-instance tracing state through tracefs. Each instance is represented by a trace_array structure whose lifetime is tied to the corresponding tracefs directory. Users can remove an instance by issuing rmdir against its directory, which frees the associated trace_array.

The newly added show_event_filters and show_event_triggers files walk every event within an instance to display configured filters or triggers. The open path for these files does not call trace_array_get() to pin the instance. As a result, nothing prevents the trace_array from being freed while a reader is still iterating events, producing a classic use-after-free condition [CWE-416].

Exploitation requires local access and the ability to open tracefs files, but the resulting memory corruption occurs in kernel context. Successful races can yield kernel crashes and, depending on the freed object reuse, potential privilege escalation.

Root Cause

The root cause is missing reference counting on the trace_array object during the open of the show_event_filters and show_event_triggers files. Without trace_array_get(), the tracing subsystem does not enforce lifetime ordering between file readers and instance teardown via rmdir.

Attack Vector

A local attacker with permission to access tracefs opens show_event_filters or show_event_triggers for a given trace instance. In parallel, the attacker (or another process) removes the instance directory with rmdir. The read syscall then dereferences freed trace_array memory. No network access, user interaction, or elevated privileges beyond tracefs access are required.

No public proof-of-concept code has been published for this issue. See the upstream fix commits for the exact code paths: kernel commit 2ee3f7d43f79 and kernel commit f4a771cc684c.

Detection Methods for CVE-2026-90014

Indicators of Compromise

Unexpected kernel oops or panic messages referencing show_event_filters, show_event_triggers, or trace_array in dmesg or /var/log/kern.log
KASAN use-after-free reports naming trace_array on kernels built with KASAN enabled
Unexplained tracing instance directory removals correlated with tracefs read activity

Detection Strategies

Monitor kernel logs for crash signatures involving the tracing subsystem and correlate with tracefs file descriptors held at the time of failure
Audit process activity that concurrently opens files under /sys/kernel/tracing/instances/*/events/ and issues rmdir against instance directories
Enable KASAN in test environments to surface use-after-free events during fuzzing or regression runs

Monitoring Recommendations

Ship kernel logs to a centralized logging pipeline and alert on BUG:, KASAN:, or general protection fault entries referencing tracing symbols
Track syscall telemetry for openat and rmdir operations targeting tracefs paths from non-administrative accounts
Baseline expected users of tracefs and flag deviations, since access is normally limited to root or debugging tooling

How to Mitigate CVE-2026-90014

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 2ee3f7d43f79 and f4a771cc684c as soon as vendor packages are available
Restrict access to tracefs (/sys/kernel/tracing) to trusted administrative accounts only
Audit systems where non-root users or containers have been granted CAP_SYS_ADMIN or tracefs mounts

Patch Information

The fix updates the open handlers for show_event_filters and show_event_triggers to call trace_array_get(), which pins the trace_array reference for the lifetime of the open file. This prevents rmdir from freeing the instance while a reader is active. Patches are available in the upstream stable tree via kernel commit 2ee3f7d43f79 and kernel commit f4a771cc684c.

Workarounds

Unmount tracefs or restrict its permissions where kernel tracing is not required for operations
Remove tracefs bind mounts from unprivileged containers and revoke CAP_SYS_ADMIN from workloads that do not need it
Avoid exposing per-instance tracing directories to users who can both read the affected files and remove instances

bash

# Restrict tracefs access to root only
chmod 700 /sys/kernel/tracing
mount -o remount,mode=700 /sys/kernel/tracing

# Verify running kernel version after patching
uname -r