CVE-2026-90014

A flaw was found in the Linux kernel's tracing subsystem. The show_event_filters and show_event_triggers files, which display event filters and triggers, do not correctly maintain a reference to the trace array. This allows the trace array to be freed while a user is actively reading these files. Consequently, a local attacker could trigger a use-after-free vulnerability, leading to a system crash and a denial of service.

A use-after-free can occur in the tracing subsystem because show_event_filters and show_event_triggers do not hold a trace_array reference while their seq_file readers iterate events in a tracing instance. A concurrent rmdir of the same tracing instance can free the trace_array while another task is still reading data from it, causing a kernel crash and creating a plausible memory corruption condition. For the CVSS the PR:L is used in the paranoid score because some deployments may delegate tracing or tracefs access to service accounts, reduced capability root, container root, or local users through relaxed permissions. The issue is not network reachable and requires local access to tracing control files. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to use-after-free memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.