Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90002— ftrace: Take trace_array reference before accessing its ftrace_ops

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： ftrace：在访问 ftrace_ops 之前先获取 trace_array 的引用 trace 实例文件 和 已被更新，以支持针对特定 trace 实例（即 trace_arrays）进行操作。 问题描述： 当这些文件被打开时，存在一个微小的竞态窗口：代码会通过 指针指向的 来获取 的引用。然而， 本身可能被释放。如果在对实例执行 的同时打开 文件， 操作可能已经释放了 ，此时再引用它会导致“使用已释放内存”（use-after-free）错误，进而导致内核崩溃。

CVSS 7.8 · High EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1015

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 591dffdade9f07692a7dd3ed16830ec24e901ece< 177cd8966325f0ffffa3c9381f9e0422019a3973 affected
591dffdade9f07692a7dd3ed16830ec24e901ece< 83fd7eca5ab0d3ac3f23bff889175d847e21af06 affected
591dffdade9f07692a7dd3ed16830ec24e901ece< cee8f286794df916553d8d445eac5c323ec5b0f8 affected
591dffdade9f07692a7dd3ed16830ec24e901ece< 9100191e5acb2e5ea2313f436667bb5fce129f47 affected
3.15 affected
< 3.15 unaffected
6.12.112≤ 6.12.* unaffected
6.18.52≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90002

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ftrace: Take trace_array reference before accessing its ftrace_ops
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->private pointer to get a reference to the trace_array and then take its reference. The problem is that the ftrace_ops itself could be freed. If the rmdir on the instance happens at the same time the set_ftrace_filter file is opened, the rmdir could have also freed the ftrace_ops and referencing it will cause a use-after-free bug and crash the kernel. Instead, pass in the trace_array as the file private data (NULL for the top level instance), and then pass both the trace_array and the ftrace_ops to the ftrace_regex_open() function. If the trace_array is NULL, then it just uses the ftrace_ops without the need to take its reference (like normal). If the ftrace_ops is NULL, that is only the case for the top level instance and the global_ops can be used. This allows the trace_array to have its reference incremented before touching the ftrace_ops that could also be freed when the instance is.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 591dffdade9f07692a7dd3ed16830ec24e901ece ~ 177cd8966325f0ffffa3c9381f9e0422019a3973 -
Linux Linux 3.15 -

II. Public POCs for CVE-2026-90002

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90002

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90002 (1)

Other References for CVE-2026-90002 (3)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90002

No comments yet

Leave a comment