CVE-2026-90014: tracing: Have show_event_filters/triggers files take trace array ref
In the Linux kernel, the following vulnerability has been resolved:
tracing: Have showeventfilters/triggers files take trace array ref
The newly added files showeventfilters and showeventtriggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the tracearray may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (tracearray) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash.
Have the open of both those files take the tracearray reference via the tracearrayget() that prevents the tracearray from being freed while the files are opened.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify the open paths for the show_event_filters and show_event_triggers files to call trace_array_get(), keeping the trace_array referenced until the files are closed so it cannot be freed while being read.
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
A task must be reading the show_event_filters or show_event_triggers file for a trace instance while that same trace array is removed with rmdir. The affected files iterate events in the instance without holding a reference to keep the instance allocated.
What is the practical impact?
The trace array can be freed while it is still being read, resulting in a use-after-free crash.
What can be done before the fix is available?
Avoid removing a trace instance with rmdir while show_event_filters or show_event_triggers for that instance may be open or read. Coordinate access so readers finish before the instance is removed.