CVE-2026-90002 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems should assess exposure and verify patch deployment to prevent potential crashes. They should also review compensating controls for exposed systems, monitor system logs for potential crashes or errors, and track exceptions and retest remediated assets.

Why it matters

A use-after-free vulnerability in the Linux kernel's ftrace subsystem could lead to potential system crashes or errors. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential crashes.

• Potential system crashes or errors due to use-after-free vulnerability
• Need to verify patch deployment to prevent exploitation
• Requires assessment of exposure based on Linux kernel versions and configurations

Technical summary

The Linux kernel's ftrace subsystem has a use-after-free vulnerability. When opening set_ftrace_filter or set_ftrace_notrace files in a trace instance, there is a small race window where ftrace_ops could be freed, leading to a potential crash. The issue is resolved by passing the trace_array as file private data and taking its reference before accessing ftrace_ops. This change helps prevent the use-after-free bug and potential system crashes. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential crashes.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential crashes.

Recommended defensive actions

• Assess exposure by checking Linux kernel versions and configurations
• Verify patch deployment for affected systems
• Monitor system logs for potential crashes or errors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the affected Linux kernel. However, specific version information and exploitation details are not provided. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential crashes. The vulnerability was resolved by passing the trace_array as file private data and taking its reference before accessing the ftrace_ops. This change helps prevent the use-after-free bug and potential system crashes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.