CVE-2026-97443

A flaw was found in the Linux kernel's perf subsystem. During error handling for failed performance event allocation, the kernel unconditionally attempts to unregister a function tracer that was never successfully enabled. A local user can exploit this flaw to trigger a kernel warning, which may cause a system crash and Denial of Service (DoS) if the system is configured to panic on warnings.

A flaw of low impact was found in the Linux kernel's perf/ftrace subsystem. When perf_event_alloc() fails and its error cleanup path runs, perf_ftrace_function_unregister() unconditionally calls unregister_ftrace_function() without first checking whether the ftrace_ops was ever successfully registered, which triggers a WARN_ON in __unregister_ftrace_function(). A local user with the ability to open perf events can reach this error path and trigger the kernel warning. The consequence is limited to a kernel warning and taint: there is no impact on confidentiality or integrity, and a system crash / denial of service is only possible on systems explicitly configured to panic on warnings (panic_on_warn), which is not the default configuration. Red Hat therefore assesses the impact of this flaw as Low; the CVSS:3.1 base score of 5.5 (Moderate) reflects the worst-case availability scenario on panic-on-warnings systems rather than typical deployments.

The vulnerable behavior was introduced by the perf/core simplification of the perf_event_alloc() error path (upstream commit e1419f744ecd), so only recent kernel streams are affected: Red Hat Enterprise Linux 10 kernel streams rhel-10.2.z, rhel-10.3, and rhel-10.4, and the Red Hat In-Vehicle OS (RHIVOS) 2.x kernel streams, all of which currently have the fix deferred. RHEL 6, 7, 8, 9, and RHEL 10.0 kernels, as well as the OpenShift RHCOS kernels, do not contain the vulnerable code and are not affected. While the fix remains deferred on the affected streams, the residual risk is limited to a local user triggering a low-severity kernel warning.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.