CVE-2026-90002

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Take trace_array reference before accessing its ftrace_ops

The trace instance files set_ftrace_filter and set_ftrace_notrace was

updated to work with specific trace instances (trace_arrays). The issue is

that when these files are opened, there is a small race window where it

will use the ftrace_ops from the inode->private pointer to get a reference

to the trace_array and then take its reference. The problem is that the

ftrace_ops itself could be freed. If the rmdir on the instance happens at

the same time the set_ftrace_filter file is opened, the rmdir could have

also freed the ftrace_ops and referencing it will cause a use-after-free

bug and crash the kernel.

Instead, pass in the trace_array as the file private data (NULL for the

top level instance), and then pass both the trace_array and the ftrace_ops

to the ftrace_regex_open() function. If the trace_array is NULL, then it

just uses the ftrace_ops without

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References