CVE-2026-97937

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ftrace: fork: Initialize function graph state before copy_exec_state()

dup_task_struct() copies the parent's task_struct, including ret_stack.

ftrace_graph_init_task() clears the copied function graph state, but it

currently runs after copy_exec_state().

For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.

If that allocation fails, copy_process() reaches bad_fork_free and

free_task() calls ftrace_graph_exit_task(). Since the child still carries

the parent's ret_stack pointer, the unwind frees the parent's active

function graph return stack. The parent subsequently accesses freed memory

from function_graph_enter_regs().

KASAN reports:

[ 22.190920] ==================================================================

[ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90

[ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1

[ 22.205134]

[ 22

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References