CVE-2026-90002

The Linux kernel's ftrace subsystem contains a use-after-free in the handling of per-instance set_ftrace_filter and set_ftrace_notrace files. When such a file is opened, the code dereferences an ftrace_ops pointer stored in the inode's private data to take a reference on the trace instance (trace_array); if an administrator removes the instance via rmdir during that window, the ftrace_ops may already have been freed, and touching it corrupts kernel memory and can crash the kernel. Triggering it requires local code execution and access to tracefs, plus a concurrent rmdir of a tracing instance while an instance filter file is opened — a narrow but scriptable race. On systems that grant low-privileged users access to tracefs, this is exploitable for denial of service (kernel crash) and, per the CVSS vector's high confidentiality/integrity/availability ratings, potentially for local privilege escalation. No public proof-of-concept is known and the flaw is not in the CISA KEV catalog, so exploitation has not been observed.

What to do: Patch kernels with the ftrace fix from the upstream commit (available via backports in distribution kernel updates; check your vendor's errata for CVE-2026-90002). As a mitigation, restrict /sys/kernel/tracing (tracefs) to root or fully trusted groups, and avoid concurrently removing trace instances while instance filter files are open. Verify exposure by checking whether tracefs is mounted and which users or groups have read/write access to it.