CVE-2026-97443: perf/ftrace: Fix WARNING in __unregister_ftrace_function
In the Linux kernel, the following vulnerability has been resolved:
perf/ftrace: Fix WARNING in unregisterftracefunction
perfftracefunctionunregister() unconditionally calls unregisterftracefunction() without checking whether the ftraceops was ever successfully registered. This triggers a WARNON in unregisterftracefunction() when the ops doesn't have FTRACEOPSFLENABLED set.
This can happen during perfeventalloc() error cleanup when perftracedestroy() is called via freeevent() on an event whose ftraceops registration failed or was already torn down by perftryinitevent()'s errdestroy path.
The call path is: perfeventalloc() error cleanup -> freeevent() -> event->destroy() [tpperfeventdestroy] -> perftracedestroy() -> perftraceeventclose() -> TRACEREGPERFCLOSE -> perfftracefunctionunregister() -> unregisterftracefunction() -> unregisterftracefunction() -> WARNON(!(ops->flags & FTRACEOPSFLENABLED))
Fix this by checking FTRACEOPSFLENABLED before attempting to unregister. If the ops is not enabled, just free the filter and return success.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this warning occur?
It can occur during perf_event_alloc() error cleanup when ftrace-ops registration failed, or when the operations were already torn down through perf_try_init_event() error handling. The cleanup path then attempts to unregister operations that were never successfully enabled.
Does exploitation require an attacker to have access to perf event creation or tracing functionality?
The provided information identifies the triggering path as perf event allocation and trace-event cleanup, but does not state attacker prerequisites, privilege requirements, or a remote attack vector.
What is the mitigation if the fix cannot be applied immediately?
No operational workaround is provided. The described fix is to avoid unregistering ftrace operations unless the FTRACE_OPS_FL_ENABLED flag is set, and otherwise free the filter and return success.