CVE-2026-90013

A flaw was found in the Linux kernel's tracing subsystem. When an options file is opened, it fails to properly manage references to the associated trace array. This oversight allows a local attacker to trigger a use-after-free condition by removing the trace array instance while the options file is still in use. Successful exploitation of this vulnerability can lead to a kernel crash, resulting in a Denial of Service (DoS).

A race in tracefs options handling can cause a use-after-free because opening an options file did not take a reference on the related trace_array. One local task can keep an options file open while another task removes the tracing instance, leaving a stale trace_flags_index pointer that may later be used by read, write, or release paths. For the CVSS the PR:L is used for the paranoid score because some deployments delegate tracing controls to a less privileged local user, container root, or service account even though default systems usually restrict this to administrators. The issue is not network reachable and requires local access to tracefs control paths.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.