Look up another CVE · open CVE-2026-90014 in the interactive tracker
CVE-2026-90014
tracing: Have show_event_filters/triggers files take trace array ref
Published 2026-09-16 (33 days ago) by the Linux kernel CNA. Subsystem kernel/trace. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-90014 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (trace_array) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash. Have the open of both those files take the trace_array reference via the trace_array_get() that prevents the trace_array from being freed while the files are opened.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/trace/trace_events.c
- What this is
- TRACINGMAINTAINERS section matched on kernel/trace/ · linux-kernel@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_EVENT_TRACING|CONFIG_FUNCTION_TRACER|CONFIG_RETHOOK|CONFIG_RING_BUFFER|CONFIG_TRACEPOINTS|CONFIG_TRACE_CLOCK|CONFIG_TRACING' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormYnot built on arm64/arm64, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le
- trixieYnot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- forky, sidYnot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae
- Y
- built in where it is built at all; some flavours do not build it
- Build switches
- CONFIG_EVENT_TRACING, CONFIG_FUNCTION_TRACER, CONFIG_RETHOOK, CONFIG_RING_BUFFER, CONFIG_TRACEPOINTS, CONFIG_TRACE_CLOCK, CONFIG_TRACING
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-16 (33 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/trace
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.0 | 7.2.5 | 2ee3f7d43f79 |
| 7.0 | 7.3 | f4a771cc684c |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached only via local tracefs: open/read of instances/<name>/show_event_filters or show_event_triggers (ftrace_event_show_*_open -> seq_read -> t_start) concurrent with rmdir(2) of that instance (tracefs_syscall_rmdir -> instance_rmdir -> __remove_instance). There is no network, adjacent-radio, or physical path.
- AC:LAttack complexity, low
- The attacker owns both sides and can trigger it sequentially: mkdir an instance, open show_event_filters/triggers (no trace_array ref), rmdir it (__remove_instance sees tr->ref==1 and kfree()s tr), then read the still-open fd. No victim state or uninfluenced layout is required; CONFIG_TRACING is standard.
- PR:LPrivileges required, low
- The open path checks only LOCKDOWN_TRACEFS and DAC (files are 0440; instance mkdir/rmdir has no capable() gate). Tracefs uid=/gid=/mode= mounts on Android/Perfetto, ChromeOS, and distro tracing groups grant this to unprivileged users, matching CVE-2024-50207, CVE-2025-38101, and CVE-2026-74634.
- UI:NUser interaction, none
- The attacker creates the instance, opens the seq file, rmdirs it, and reads the fd from their own threads. No separate victim mount, click, or cooperating process is required.
- S:UScope, unchanged
- The use-after-free corrupts the host kernel's trace_array and event-file heap objects within the same OS security authority. It enables local privilege escalation but does not cross a VM, IOMMU, sandbox, or hardware trust boundary.
- C:HConfidentiality impact, high
- After rmdir kfree()s the trace_array and its trace_event_file objects, t_start/t_next walk the freed tr->events list and t_show_filters copies filter->filter_string to userspace via seq_printf, disclosing recycled kernel heap. Use-after-free is scored C:H.
- I:HIntegrity impact, high
- t_show_triggers invokes data->cmd_ops->print() on use-after-free trigger objects, and walking the freed tr->events list is a heap UAF write/control-flow primitive after spraying. Use-after-free is scored I:H.
- A:HAvailability impact, high
- syzkaller reported a KASAN slab-use-after-free in t_start/t_next when the instance is removed while the file is read, which oopses or panics the kernel. Any use-after-free of the trace_array is a reliable whole-system crash even without full exploitation.