CVE-2026-90014 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing: Have show_event_filters/triggers files take trace array ref
The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (trace_array) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash.
Have the open of both those files take the trace_array reference via the trace_array_get() that prevents the trace_array from being freed while the files are opened.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel tracing subsystem contains a critical concurrency flaw within the file operations for show_event_filters and show_event_triggers, which expose information about active filters and triggers set on specific trace arrays. These interfaces allow user-space processes to read detailed configuration data regarding how system events are being monitored or manipulated. The core technical deficiency lies in the lifecycle management of the underlying trace_array structure during these read operations. When a process opens one of these files to iterate through all configured events within an instance, it accesses memory associated with that specific trace array without acquiring a reference count on it. This omission creates a race condition where the kernel's internal cleanup mechanisms can free the trace_array object while user-space is still actively reading from it.
The operational impact of this vulnerability manifests as a use-after-free crash, which typically results in a kernel panic or system instability. An attacker with local access to the tracing subsystem can exploit this by opening one of these files and simultaneously triggering the removal of the corresponding trace array directory via rmdir commands executed from another context. Because there is no synchronization mechanism preventing the deallocation of the trace_array during the read operation, the memory previously allocated for that structure may be reclaimed and potentially reused for other purposes before the reading task completes its iteration. Accessing freed memory leads to undefined behavior, often causing immediate system crashes or potential data corruption depending on what new allocations occupy the same memory space.
This vulnerability aligns with CWE-416, Use After Free, as it involves accessing a pointer after that memory has been made available for reallocation by the kernel allocator. From an offensive security perspective, this flaw can be leveraged in denial-of-service attacks to disrupt system availability or potentially escalated into privilege escalation if the freed memory is reused in a way that allows control over execution flow, although the primary immediate risk is stability degradation. The attack vector falls under ATT&CK technique T1059, Command and Scripting Interpreter, specifically involving local exploitation through file system interactions within the debugfs interface used for tracing configurations.
To mitigate this vulnerability, kernel developers have implemented a fix that ensures any open operation on show_event_filters or show_event_triggers explicitly takes a reference to the trace_array using the trace_array_get function. This mechanism increments the reference count of the trace array object, thereby preventing its deallocation until all file descriptors associated with it are closed and released by user-space processes. System administrators should ensure that their Linux kernels are updated to include this patch, which restores proper synchronization between resource acquisition and release in the tracing subsystem. Regularly applying kernel security updates is essential to maintain system integrity against such concurrency-related memory safety issues.