Linux Kernel EUVD-2026-28715

Three specific conditions must all be present: (1) the attacker must have local access with CAP_SYS_MODULE privilege or equivalent (PR:L per CVSS AV:L), sufficient to execute rmmod; (2) ftrace must have previously been killed via ftrace_kill() - a state triggered only by internal ftrace errors, not a normal runtime condition; and (3) a kernel module containing active kprobe probes must be loaded at the time of the rmmod operation. Exploitation is limited to scenarios where all three conditions coincide. There is no remote attack vector (AV:L confirmed by CVSS), no user interaction required beyond the privileged rmmod call, and the vulnerable code path is only reached when kprobes and ftrace are both in active use. The requirement for a prior ftrace failure state makes opportunistic mass exploitation implausible.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects a local, low-complexity denial-of-service with no confidentiality or integrity impact. The EPSS score of 0.02% at the 5th percentile strongly corroborates low real-world exploitation probability, consistent with the narrow preconditions required. No CISA KEV listing and no public exploit code have been identified at time of analysis. The practical risk is further constrained by the need for CAP_SYS_MODULE or equivalent capability to perform rmmod operations - this is not a default user privilege. The attack also requires that ftrace has already been killed by a prior error, an uncommon production state. Despite low CVSS score for impact being 'only' DoS, a kernel crash on a production system or container host carries significant operational impact. Overall, this is a low-priority, narrow-scope issue for most environments unless kprobes/ftrace instrumentation is actively in use alongside untrusted module loading.

A local user with CAP_SYS_MODULE (or root) loads a kernel module instrumented with kprobes, waits for or deliberately induces a condition that triggers ftrace_kill() setting the kprobe_ftrace_disabled flag, then executes rmmod on that module. The kprobes_module_callback fires without checking kprobe_ftrace_disabled, accesses invalid ftrace memory, and causes a kernel page fault (BUG/Oops), crashing the system or the affected CPU context. No public exploit code has been identified at time of analysis.