What is the CVSS score of CVE-2026-97937?

CVE-2026-97937 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-97937?

Within 24 hours, inventory Linux kernels across servers, endpoints, and cloud images and identify any systems with function_graph tracing enabled or tracefs exposed beyond root; document owners and exposure. Within 7 days, apply the latest vendor-released kernel security updates from your Linux distribution or kernel.org stable branch for CVE-2026-97937, using the applicable vendor advisory and supported kernel package for each platform (Patch available per vendor advisory); where patching is delayed, disable function_graph tracing, restrict tracefs mounts to trusted administrators, and monitor for memory-pressure or fork failures. Within 30 days, validate remediation through configuration review and vulnerability scanning, confirm no production systems retain the vulnerable tracing configuration, and update hardening baselines to keep ftrace diagnostics off unless formally approved.

Linux Kernel CVE-2026-97937

EUVD-2026-86791 HIGH

2026-09-25 Linux

GHSA-79j5-369g-hx4m

Linux Debian Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Enable function_graph tracer via tracefs
Delivery

Fork under induced memory pressure
Exploit

copy_exec_state allocation fails
Execution

Cleanup frees parent's active ret_stack
Persist

Parent's traced call writes freed memory
Impact

Kernel UAF crash/corruption (DoS)

Vulnerability Assessment

Exploitation Conditions	Requires the ftrace function_graph tracer to be actively enabled (configured and turned on via tracefs, which normally needs root/privileged access) AND a non-CLONE_VM fork in which copy_exec_state()'s task_exec_state allocation fails - i.e., the free of the parent's active return stack only happens on the fork error path, so the attacker must induce an allocation failure (memory pressure). It is a local, config-dependent condition, not a default-configuration remote flaw; systems without function_graph tracing active are not affected. There is no user interaction from a victim and no network reachability.
Impact	The published CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) overstates real-world risk. This is a slab use-after-free in the kernel fork path: on a non-CLONE_VM fork, if copy_exec_state()'s task_exec_state allocation fails, the error unwind (bad_fork_free → free_task → ftrace_graph_exit_task) frees the parent's still-active function_graph return stack because the child was cloned with the parent's ret_stack pointer before it was cleared. The parent then writes to freed memory in function_graph_enter_regs (KASAN confirms an 8-byte slab-use-after-free write). Two hard gating conditions blunt severity: (1) the function_graph tracer must be actively enabled (a debug/observability feature normally reachable only through privileged tracefs access, rarely on in production), and (2) the allocation must fail - i.e., the bug is memory-pressure/ENOMEM-triggered, not directly attacker-controlled, so AC:L is really AC:H. The impact is a UAF write leading to crash/corruption (DoS-dominant), not data disclosure, so C:H is not supported. There is no EPSS score, no CISA KEV listing, and no public exploit; SSVC data is not provided. Net: a legitimate correctness bug worth patching, but low practical priority - not a widely exploitable network-facing flaw.
Exploit ScenarioDerived	On a system where an administrator has enabled the ftrace function_graph tracer, a local process repeatedly forks (non-CLONE_VM) under memory pressure so that copy_exec_state()'s allocation fails. The failed-fork cleanup frees the parent's active function-graph return stack, and the parent's next traced function call writes into freed slab memory, crashing the kernel or corrupting memory. No public exploit code is identified at time of analysis; the description references only a KASAN reproducer.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A memory-lifetime bug in the Linux kernel's ftrace function-graph tracer allows a child task to free its parent's active function-graph return stack (ret_stack), after which the parent writes to the freed slab object inside function_graph_enter_regs(). The flaw is reachable only on the fork error path: ftrace_graph_init_task() runs after copy_exec_state(), so when a non-CLONE_VM fork's task_exec_state allocation fails under memory pressure, copy_process() unwinds through bad_fork_free/free_task() and ftrace_graph_exit_task() frees the still-shared parent ret_stack; systems that never enable the function_graph tracer are unaffected, and the trigger path normally requires privileged (tracefs) access, so exploitation prerequisites are local and configuration-dependent. Published CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H), but our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because the attacker must both have function_graph tracing active and force an allocation failure; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.

RemediationAI

Apply the vendor-released kernel patch: upgrade to a stable kernel containing upstream commit 1fadebbbf31f65beba353fa9d1373bf183e03fed (Linux 7.2.7) or commit 08cacffeef8f64f1a222c93467ca84f24a46c953 (Linux 7.3-rc3), available at https://git.kernel.org/stable/c/1fadebbbf31f65beba353fa9d1373bf183e03fed and https://git.kernel.org/stable/c/08cacffeef8f64f1a222c93467ca84f24a46c953; the EUVD/NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-97937 tracks the same fix set. If immediate patching is not possible, the most effective compensating control is to not enable the function-graph tracer: keep the function_graph option off in tracefs (do not activate it via /sys/kernel/tracing or debugfs), which removes the vulnerable code path entirely, at the cost of losing function-graph latency/tracing visibility; additionally, restrict write access to tracefs/debugfs to fully trusted root processes, since enabling the tracer normally requires privileged access. Because the free of the parent's ret_stack only occurs on the fork allocation-failure path, reducing memory pressure on the host lowers the probability of the trigger but does not eliminate the underlying defect, and neither workaround addresses the faulty init ordering, so patching remains the only complete fix.

Affected VersionsENISA

Linux 6b1c66c9cca99bf00386481c7b2aa7394c26d8b8 <08cacffeef8f64f1a222c93467ca84f24a46c953

Linux patch: 0

Linux 7.2

Linux patch: 7.3-rc3

Linux patch: 7.2.7

Linux 6b1c66c9cca99bf00386481c7b2aa7394c26d8b8 <1fadebbbf31f65beba353fa9d1373bf183e03fed

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The bug lives in the interaction between task_struct duplication and ftrace's function-graph accounting. dup_task_struct() copies the parent's task_struct wholesale, including its ret_stack pointer, the per-task return-stack used to unwind function-graph entries. ftrace_graph_init_task() is supposed to clear that inherited function-graph state for the new child, but in the vulnerable ordering it executes only after copy_exec_state(). On a non-CLONE_VM fork, copy_exec_state() allocates a fresh task_exec_state; should that allocation fail, copy_process() jumps to bad_fork_free, and free_task() calls ftrace_graph_exit_task(). Because the child still references the parent's ret_stack, the unwind tears down the parent's live function-graph return stack rather than the child's, and the parent later performs a write into the freed slab object from function_graph_enter_regs(), as reported by KASAN ('slab-use-after-free ... Write of size 8'). The provided data lists no CWE, but the signature and the fix identify this as the use-after-free / memory-lifetime class (CWE-416 style): state is not initialized early enough and a later fallible operation invalidates an object still reachable through an aliased pointer. The correction is ordering: initialize the child's function-graph state immediately after dup_task_struct(), before the first fallible operation in copy_process().

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 5.3 MEDIUM

Local only (AV:L); requires function_graph tracing active plus an induced allocation failure, so AC:H and PR:L; UAF write causes crash/corruption (A:H, I:L) with no disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 25, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Sep 25, 2026 - 11:02 EUVD

CVE Published

Sep 25, 2026 - 10:22 cve.org

HIGH 7.8

CVE Published

Sep 25, 2026 - 10:22 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ftrace: fork: Initialize function graph state before copy_exec_state()

dup_task_struct() copies the parent's task_struct, including ret_stack. ftrace_graph_init_task() clears the copied function graph state, but it currently runs after copy_exec_state().

For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state. If that allocation fails, copy_process() reaches bad_fork_free and free_task() calls ftrace_graph_exit_task(). Since the child still carries the parent's ret_stack pointer, the unwind frees the parent's active function graph return stack. The parent subsequently accesses freed memory from function_graph_enter_regs().

KASAN reports:

[ 22.190920] ============== [ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90 [ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1 [ 22.205134] [ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy) [ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.213750] Call Trace: [ 22.215271] <TASK> [ 22.216242] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.217774] dump_stack_lvl+0x4e/0x70 [ 22.220531] print_report+0x157/0x4b4 [ 22.223202] ? fixup_red_left+0x9/0x30 [ 22.224407] ? complete_report_info+0x83/0x110 [ 22.226679] ? function_graph_enter_regs+0xa76/0xb90 [ 22.228084] kasan_report+0xce/0x100 [ 22.230109] ? function_graph_enter_regs+0xa76/0xb90 [ 22.232860] ? stack_trace_save+0x4/0xd0 [ 22.234156] function_graph_enter_regs+0xa76/0xb90 [ 22.236090] ? kasan_save_stack+0x30/0x50 [ 22.237752] ? __pfx_function_graph_enter_regs+0x10/0x10 [ 22.238694] ? ring_buffer_lock_reserve+0x345/0xf80 [ 22.239628] ? stack_trace_save+0x4/0xd0 [ 22.242121] ? stack_trace_save+0x4/0xd0 [ 22.243588] ftrace_graph_func+0xda/0x160 [ 22.245362] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.246520] 0xffffffffa0000095 [ 22.250528] ? stack_trace_save+0x9/0xd0 [ 22.251757] ? ring_buffer_unlock_commit+0x11d/0x5c0 [ 22.253152] stack_trace_save+0x9/0xd0 [ 22.254264] kasan_save_stack+0x30/0x50 [ 22.273631] kasan_save_track+0x14/0x30 [ 22.276763] kasan_save_free_info+0x3b/0x70 [ 22.278296] __kasan_slab_free+0x43/0x70 [ 22.280157] kmem_cache_free+0xbf/0x3b0 [ 22.282963] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.284001] free_task+0xa2/0x160 [ 22.285699] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.286752] copy_process+0x2aae/0x7bc0

Initialize the child function graph state immediately after dup_task_struct(), before the first fallible operation.

Executive ViewAI

Why It Matters

Linux kernel systems with the function-graph tracer enabled may face a local memory-corruption issue affecting the ftrace subsystem, with potential integrity and availability impact on affected hosts. Exploitation requires an authenticated local user with tracefs access and specific fork/memory-pressure conditions, and no public exploit identified at time of analysis, so broad opportunistic attacks are unlikely. Leadership should prioritize patching for any production Linux estate where ftrace diagnostics are used, while confirming whether such tracing is enabled in managed server and endpoint builds.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 96% exploitable

Prevalence

Low

Linux kernel is ubiquitous, but vulnerable path needs function_graph tracer actively enabled

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97937 REF https://git.kernel.org/stable/c/08cacffeef8f64f1a222c93467ca84f24a46c953 REF https://git.kernel.org/stable/c/1fadebbbf31f65beba353fa9d1373bf183e03fed

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back