CVE-2026-90014

The Linux kernel tracing subsystem's show_event_filters and show_event_triggers files, which display all filters or triggers set within a trace array (trace instance), do not take a reference on the trace array they are reading. A local attacker can trigger a race by holding one of these files open (iterating its events) while the trace instance is deleted via 'rmdir', freeing the trace_array while its data is still being read, resulting in a use-after-free kernel crash and potentially local privilege escalation (CVSS C:H/I:H/A:H). Any Linux system running a kernel that includes these recently added tracing files is affected, provided a local user can access the tracefs interface. No public proof-of-concept is known and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Update affected systems to a kernel release that includes the tracing fix adding the trace_array_get() reference in the open handlers of show_event_filters/show_event_triggers. As interim mitigation, restrict access to /sys/kernel/tracing (tracefs) to root or trusted groups so unprivileged local users cannot race file reads against instance 'rmdir' operations. Check whether tracefs is mounted and these files are present on your systems to determine applicability.