CVE-2026-97937 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ftrace: fork: Initialize function graph state before copy_exec_state()
dup_task_struct() copies the parent's task_struct, including ret_stack. ftrace_graph_init_task() clears the copied function graph state, but it currently runs after copy_exec_state().
For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state. If that allocation fails, copy_process() reaches bad_fork_free and free_task() calls ftrace_graph_exit_task(). Since the child still carries the parent's ret_stack pointer, the unwind frees the parent's active function graph return stack. The parent subsequently accesses freed memory from function_graph_enter_regs().
KASAN reports:
[ 22.190920] ==================================================================
[ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90
[ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1
[ 22.205134]
[ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy)
[ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 22.213750] Call Trace:
[ 22.215271] <TASK>
[ 22.216242] ? ftrace_stub_direct_tramp+0x10/0x10
[ 22.217774] dump_stack_lvl+0x4e/0x70
[ 22.220531] print_report+0x157/0x4b4
[ 22.223202] ? fixup_red_left+0x9/0x30
[ 22.224407] ? complete_report_info+0x83/0x110
[ 22.226679] ? function_graph_enter_regs+0xa76/0xb90
[ 22.228084] kasan_report+0xce/0x100
[ 22.230109] ? function_graph_enter_regs+0xa76/0xb90
[ 22.232860] ? stack_trace_save+0x4/0xd0
[ 22.234156] function_graph_enter_regs+0xa76/0xb90
[ 22.236090] ? kasan_save_stack+0x30/0x50
[ 22.237752] ? __pfx_function_graph_enter_regs+0x10/0x10
[ 22.238694] ? ring_buffer_lock_reserve+0x345/0xf80
[ 22.239628] ? stack_trace_save+0x4/0xd0
[ 22.242121] ? stack_trace_save+0x4/0xd0
[ 22.243588] ftrace_graph_func+0xda/0x160
[ 22.245362] ? ftrace_stub_direct_tramp+0x10/0x10
[ 22.246520] 0xffffffffa0000095
[ 22.250528] ? stack_trace_save+0x9/0xd0
[ 22.251757] ? ring_buffer_unlock_commit+0x11d/0x5c0
[ 22.253152] stack_trace_save+0x9/0xd0
[ 22.254264] kasan_save_stack+0x30/0x50
[ 22.273631] kasan_save_track+0x14/0x30
[ 22.276763] kasan_save_free_info+0x3b/0x70
[ 22.278296] __kasan_slab_free+0x43/0x70
[ 22.280157] kmem_cache_free+0xbf/0x3b0
[ 22.282963] ? ftrace_stub_direct_tramp+0x10/0x10
[ 22.284001] free_task+0xa2/0x160
[ 22.285699] ? ftrace_stub_direct_tramp+0x10/0x10
[ 22.286752] copy_process+0x2aae/0x7bc0
Initialize the child function graph state immediately after dup_task_struct(), before the first fallible operation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel ftrace subsystem contains a critical race condition and use-after-free vulnerability within the task creation path, specifically involving the initialization of the function graph tracer state during process forking operations. This flaw arises from an incorrect ordering of initialization routines in the dup_task_struct implementation. When a new task is created via fork or clone system calls that do not share memory with the parent (non-CLONE_VM), the kernel copies the entire parent's task structure, including the ret_stack pointer which tracks function graph return addresses for tracing purposes. The vulnerability stems from the fact that ftrace_graph_init_task(), responsible for clearing and initializing this copied state to prevent inheritance of stale or invalid pointers, was executed after copy_exec_state(). This sequence creates a dangerous window where memory management operations can fail before the child task's tracing context is properly isolated from the parent.
The operational impact manifests when copy_exec_state() attempts to allocate new execution state structures for the child process and fails due to resource constraints such as memory pressure or fragmentation. In this failure scenario, the kernel proceeds to the bad_fork_free error handling path, which invokes free_task() to clean up partially allocated resources. Crucially, because ftrace_graph_init_task had not yet run on the child task at this point, the child's ret_stack pointer still references the parent's active function graph return stack memory region. Consequently, when free_task() calls ftrace_graph_exit_task(), it attempts to unwind and free the parent's tracing data structures using pointers that belong to the now-terminating or invalid context of the child task. This results in a slab-use-after-free condition where the parent process subsequently accesses freed memory through function_graph_enter_regs(), leading to potential kernel crashes, data corruption, or arbitrary code execution if an attacker can influence the allocation failure timing and subsequent tracing operations.
This vulnerability is classified under CWE-416: Use After Free, as it involves accessing memory that has already been deallocated by the system's memory management subsystem. The specific mechanism aligns with ATT&CK technique T1059: Command and Scripting Interpreter in contexts where kernel-level exploitation could facilitate privilege escalation or denial of service against critical tracing infrastructure. The KASAN reports confirm a write operation to a freed slab object, indicating that the parent process is writing into memory regions that have been returned to the allocator pool for reuse by other processes. This not only compromises system stability but also introduces security risks where malicious actors might exploit the use-after-free condition to overwrite kernel data structures or execute arbitrary code with root privileges.
Mitigation requires ensuring that all initialization of task-specific tracing state occurs before any operation that may fail and trigger cleanup routines that interact with shared resources like ret_stack pointers. The resolved fix involves moving the call to ftrace_graph_init_task() to immediately follow dup_task_struct(), thereby guaranteeing that the child's function graph state is cleared and isolated from the parent before copy_exec_state() performs its potentially failing memory allocations. System administrators should apply kernel updates containing this patch promptly, particularly in environments where high-frequency process creation occurs or under heavy memory load conditions that increase the likelihood of allocation failures during fork operations. Regular auditing of ftrace configurations and monitoring for KASAN reports can help detect residual instances of this vulnerability in unpatched systems.