CVE-2026-90002

A flaw was found in the Linux kernel's ftrace component. A race condition exists when opening trace instance files, such as set_ftrace_filter or set_ftrace_notrace, concurrently with a directory removal operation on the trace instance. This timing issue can lead to a use-after-free vulnerability, allowing an attacker to cause a kernel crash, resulting in a Denial of Service (DoS).

A race in ftrace trace instance handling can cause a use-after-free when set_ftrace_filter or set_ftrace_notrace is opened while the same trace instance is being removed. The old open path could read ftrace_ops from inode private data before safely taking a trace_array reference, so a concurrent rmdir could free the ftrace_ops and leave the opener dereferencing stale kernel memory. For the CVSS the PR:L is used for the paranoid score because local code execution with delegated tracefs access or reduced administrative tracing access may be enough to race file open against trace instance removal. The issue is not network reachable and requires local interaction with tracefs control files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.