HIGH Introduced in 7.0
tracing TraceArray UAF
CVE-2026-90014
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Have show_event_filters/triggers files take trace array ref The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (trace_array) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash. Have the open of both those files take the trace_array reference via the trace_array_get() that prevents the trace_array from being freed while the files are opened.
02KernelScan AI Analysis
Risk summary
A local attacker with root or CAP_SYS_ADMIN privileges can trigger a use-after-free in the kernel tracing subsystem by racing a read of the show_event_filters or show_event_triggers files against removal of the trace instance. This can crash the kernel or potentially lead to privilege escalation or information disclosure. Systems without interactive root access are not at practical risk.
Vulnerability analysis
Two tracing files that list active event filters and triggers do not hold a reference to the underlying instance data while it is being read. If a tracing instance is removed while one of these files is open, the data can be freed while the read is still iterating over it, resulting in a use-after-free. The fix acquires a reference when the files are opened and releases it when they are closed, preventing the data from being freed during an active read. Triggering this requires local access with root or CAP_SYS_ADMIN privileges to both open the trace files and remove tracing instances, and it depends on winning a race between the two operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.5 | 2ee3f7d43f79 |
| mainline | 7.0 | 7.3 | f4a771cc684c |