CVE-2026-89749: tracing: Fix crash passing ERR_PTR to kthread_stop()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix crash passing ERRPTR to kthreadstop()
eventteststuff() calls kthreadrun() and unconditionally passes the returned taskstruct pointer to kthreadstop(). kthreadrun() returns an error pointer such as ERRPTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthreadstop() then dereferences the invalid pointer, crashing the kernel.
Check the result of kthreadrun() before passing it to kthreadstop(). Use WARNON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERRPTR to kthreadstop()").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify event_test_stuff() (boot-time event self-test) to check the returned task_struct pointer from kthread_run() and avoid passing an ERR_PTR (e.g., ERR_PTR(-ENOMEM)) to kthread_stop(). Use WARN_ON() so self-test thread creation failure is detected without causing kernel crash.
Linux kernel (event self-test / ring-buffer self-test) kthread_run() result handling = Check for errors before passing to kthread_stop(); use WARN_ON() on self-test thread creation failure
Event History
Frequently Asked Questions
Under what conditions can this crash occur?
The crash requires kthread_run() to fail while the tracing event self-test is running, such as when memory pressure prevents creation of the self-test kernel thread. The vulnerable code then passes the resulting error pointer to kthread_stop().
Is an external attacker able to trigger this directly?
The provided information identifies a kernel crash caused by failure to create a self-test thread, but does not describe an external attack path or required attacker privileges.
What is the immediate mitigation if the fix cannot be applied?
Avoid conditions that cause kernel-thread creation to fail during the boot-time event self-test, particularly memory pressure. The provided fix adds a result check and WARN_ON() so a failed self-test thread creation is reported rather than passed to kthread_stop().
How can administrators identify an affected failure?
Look for a kernel crash associated with the tracing event self-test after kthread_run() fails and an ERR_PTR value is passed to kthread_stop(). The fixed behavior emits a warning for self-test thread creation failure instead of dereferencing the invalid pointer.