CVE-2026-97937: ftrace: fork: Initialize function graph state before copy_exec_state()
In the Linux kernel, the following vulnerability has been resolved:
ftrace: fork: Initialize function graph state before copyexecstate()
duptaskstruct() copies the parent's taskstruct, including retstack. ftracegraphinittask() clears the copied function graph state, but it currently runs after copyexecstate().
For non-CLONEVM forks, copyexecstate() allocates a new taskexecstate. If that allocation fails, copyprocess() reaches badforkfree and freetask() calls ftracegraphexittask(). Since the child still carries the parent's retstack pointer, the unwind frees the parent's active function graph return stack. The parent subsequently accesses freed memory from functiongraphenterregs().
KASAN reports:
[ 22.190920] ================================================================== [ 22.195899] BUG: KASAN: slab-use-after-free in functiongraphenterregs+0xa76/0xb90 [ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1 [ 22.205134] [ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy) [ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.213750] Call Trace: [ 22.215271] <TASK> [ 22.216242] ? ftracestubdirecttramp+0x10/0x10 [ 22.217774] dumpstacklvl+0x4e/0x70 [ 22.220531] printreport+0x157/0x4b4 [ 22.223202] ? fixupredleft+0x9/0x30 [ 22.224407] ? completereportinfo+0x83/0x110 [ 22.226679] ? functiongraphenterregs+0xa76/0xb90 [ 22.228084] kasanreport+0xce/0x100 [ 22.230109] ? functiongraphenterregs+0xa76/0xb90 [ 22.232860] ? stacktracesave+0x4/0xd0 [ 22.234156] functiongraphenterregs+0xa76/0xb90 [ 22.236090] ? kasansavestack+0x30/0x50 [ 22.237752] ? pfxfunctiongraphenterregs+0x10/0x10 [ 22.238694] ? ringbufferlockreserve+0x345/0xf80 [ 22.239628] ? stacktracesave+0x4/0xd0 [ 22.242121] ? stacktracesave+0x4/0xd0 [ 22.243588] ftracegraphfunc+0xda/0x160 [ 22.245362] ? ftracestubdirecttramp+0x10/0x10 [ 22.246520] 0xffffffffa0000095 [ 22.250528] ? stacktracesave+0x9/0xd0 [ 22.251757] ? ringbufferunlockcommit+0x11d/0x5c0 [ 22.253152] stacktracesave+0x9/0xd0 [ 22.254264] kasansavestack+0x30/0x50 [ 22.273631] kasansavetrack+0x14/0x30 [ 22.276763] kasansavefreeinfo+0x3b/0x70 [ 22.278296] kasanslabfree+0x43/0x70 [ 22.280157] kmemcachefree+0xbf/0x3b0 [ 22.282963] ? ftracestubdirecttramp+0x10/0x10 [ 22.284001] freetask+0xa2/0x160 [ 22.285699] ? ftracestubdirecttramp+0x10/0x10 [ 22.286752] copyprocess+0x2aae/0x7bc0
Initialize the child function graph state immediately after duptaskstruct(), before the first fallible operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Initialize the child function graph state by calling ftrace_graph_init_task() immediately after dup_task_struct(), before the first fallible operation and before copy_exec_state(), so the copied function graph state and ret_stack are cleared.
Event History
Frequently Asked Questions
What runtime conditions are needed to reach the faulty cleanup path?
A non-CLONE_VM fork must occur while the parent has an active function graph return stack, and allocation of the new task_exec_state in copy_exec_state() must fail. The resulting child cleanup can then free the parent's copied ret_stack.
Are workloads without function graph tracing likely to exercise this issue?
The described failure depends on the child carrying the parent's active function graph return stack. The report does not describe the same path when no such active function graph state is present.
What evidence indicates that this issue has been triggered?
The parent may subsequently access freed memory in function_graph_enter_regs(). KASAN can report this as a slab-use-after-free, including a write in function_graph_enter_regs.