EUVD-2026-80622
GHSA-jcq3-vx22-85xp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local tracefs access that is root-gated (PR:H) and a narrow open-vs-rmdir race (AC:H); UAF yields a kernel crash (A:H) and slab corruption (I:L) with no disclosure (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tracing: Have show_event_filters/triggers files take trace array ref
The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (trace_array) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash.
Have the open of both those files take the trace_array reference via the trace_array_get() that prevents the trace_array from being freed while the files are opened.
AnalysisAI
A use-after-free in the Linux kernel ftrace tracing subsystem lets a privileged local user crash the machine by racing a read of the newly added per-instance show_event_filters or show_event_triggers files against deletion (rmdir) of the trace instance those files belong to. The bug affects kernels that ship these files, i.e. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a mounted tracefs filesystem (default /sys/kernel/tracing, normally readable/traversable only by root/CAP_SYS_ADMIN) and the ability to both open the per-instance show_event_filters or show_event_triggers files AND concurrently rmdir that same trace instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local, race-condition use-after-free in the Linux kernel tracing subsystem (ftrace), not the remote/high-severity issue its numbers suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux 7.2.5 (stable) and Linux 7.3-rc2 contain the fix, applied as upstream commits f4a771cc684c7354b6200147f7252c58d17408ff and 2ee3f7d43f79efaca0cd84a6798653d9d75ce60b (see https://git.kernel.org/stable/c/f4a771cc684c7354b6200147f7252c58d17408ff, https://git.kernel.org/stable/c/2ee3f7d43f79efaca0cd84a6798653d9d75ce60b, and https://nvd.nist.gov/vuln/detail/CVE-2026-90014); upstream is the authoritative source and stable/LTS branches must confirm the two commits are present in their tree rather than relying on the version number alone. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts running kernel 7.0 through pre-fix 7.2.x or 7.3-rc and identify which of them expose a tracefs mount (commonly /sys/kernel/tracing) to non-root users or privileged containers; prioritize the vendor-released kernel containing the fix (commits f4a771cc684c and 2ee3f7d43f79) for internet-facing and business-critical systems, and where immediate patching is not possible restrict tracefs mounts to root-only with strict permissions and require CAP_SYS_ADMIN for any access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today