CVE-2026-90066: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
In the Linux kernel, the following vulnerability has been resolved:
samples/ftrace: Fix kthreadstop() on ERRPTR in ftrace-direct-multi-modify
ftracedirectmultiinit() assigns kthreadrun()'s return value to simpletsk without an ISERR() check. When kthreadrun() fails it returns ERRPTR(-ENOMEM), but init still returns 0, so the module loads with simpletsk holding an error pointer. On unload, ftracedirectmultiexit() then passes that ERRPTR to kthreadstop(), leading to a null-pointer-dereference.
Check the return value of kthreadrun() with ISERR(); on failure, unregister the ftrace direct call and propagate the error code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the ftrace-direct-multi-modify module so that after kthread_run() returns an ERR_PTR, the code does not call kthread_stop() with that ERR_PTR; update logic so init returns the propagated error code when simple_tsk holds an error pointer.
ftrace-direct-multi-modify (samples/ftrace) kthread_stop()/kthread_run() error handling = Add IS_ERR() check for kthread_run() return value and propagate failure instead of passing ERR_PTR to kthread_stop - Compensating control
On module unload, ensure that ftrace-direct-multi-modify unregisters/unregisters the ftrace direct call and propagates the error code when kthread_run() fails (instead of allowing ERR_PTR(-ENOMEM) to be passed to kthread_stop()).
Event History
Frequently Asked Questions
What condition is required to trigger the fault?
The module's kthread_run() call must fail, returning an ERR_PTR such as ERR_PTR(-ENOMEM). The fault is then triggered when the module is unloaded and its exit path passes that error pointer to kthread_stop().
What is the practical impact of the affected error path?
The unload operation can cause a null-pointer dereference. The issue is tied to the samples/ftrace ftrace-direct-multi-modify module and its thread-creation failure path.
How does the fix change behavior when thread creation fails?
The corrected code checks the kthread_run() result with IS_ERR(). On failure, it unregisters the ftrace direct call and returns the error instead of allowing the module to load with an invalid task pointer.