CVE-2026-90066: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

samples/ftrace: Fix kthreadstop() on ERRPTR in ftrace-direct-multi-modify

ftracedirectmultiinit() assigns kthreadrun()'s return value to simpletsk without an ISERR() check. When kthreadrun() fails it returns ERRPTR(-ENOMEM), but init still returns 0, so the module loads with simpletsk holding an error pointer. On unload, ftracedirectmultiexit() then passes that ERRPTR to kthreadstop(), leading to a null-pointer-dereference.

Check the return value of kthreadrun() with ISERR(); on failure, unregister the ftrace direct call and propagate the error code.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Fix the ftrace-direct-multi-modify module so that after kthread_run() returns an ERR_PTR, the code does not call kthread_stop() with that ERR_PTR; update logic so init returns the propagated error code when simple_tsk holds an error pointer.

    ftrace-direct-multi-modify (samples/ftrace) kthread_stop()/kthread_run() error handling = Add IS_ERR() check for kthread_run() return value and propagate failure instead of passing ERR_PTR to kthread_stop
  2. Compensating control

    On module unload, ensure that ftrace-direct-multi-modify unregisters/unregisters the ftrace direct call and propagates the error code when kthread_run() fails (instead of allowing ERR_PTR(-ENOMEM) to be passed to kthread_stop()).

Event History

Sep 17, 2026
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
Description

Frequently Asked Questions

1

What condition is required to trigger the fault?

The module's kthread_run() call must fail, returning an ERR_PTR such as ERR_PTR(-ENOMEM). The fault is then triggered when the module is unloaded and its exit path passes that error pointer to kthread_stop().

2

What is the practical impact of the affected error path?

The unload operation can cause a null-pointer dereference. The issue is tied to the samples/ftrace ftrace-direct-multi-modify module and its thread-creation failure path.

3

How does the fix change behavior when thread creation fails?

The corrected code checks the kthread_run() result with IS_ERR(). On failure, it unregisters the ftrace direct call and returns the error instead of allowing the module to load with an invalid task pointer.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203