CVE-2026-97937

A flaw was found in the Linux kernel. During process creation when the Function Tracer (ftrace) graph functionality is active, a memory allocation failure can lead to the kernel prematurely releasing memory still referenced by the parent process. A local attacker could exploit this use-after-free flaw to crash the system, resulting in a Denial of Service (DoS), or potentially escalate privileges.

A MODERATE use-after-free flaw was found in the Linux kernel's function graph tracing (ftrace) subsystem. When function graph tracing is active, a failed memory allocation during the creation of a new process (a fork without CLONE_VM) can cause the cleanup path of the failed fork to free the parent's function graph return stack, which the child had inherited via dup_task_struct(). The parent process subsequently writes to that freed memory when entering traced functions, which can result in kernel memory corruption. A local unprivileged attacker could exploit this flaw to crash the system (denial of service) or, in the worst case, escalate privileges. Exploitation requires function graph tracing to be enabled and a memory allocation failure to occur at the right point during fork, which is why Red Hat rates the attack complexity as high (CVSS 7.0), while the CVE.org record scores the flaw 7.8 with low attack complexity.

Currently, only Red Hat Enterprise Linux 6 Extended Lifecycle Support is listed on this flaw and its affectedness is still being assessed. Red Hat Enterprise Linux 7, 8, 9, and 10, RHEL for Automotive, and OpenShift 4 and later are marked not affected because the vulnerable code is not present in those kernels. The upstream fix initializes the child's function graph state immediately after dup_task_struct(), before the first fallible operation, so a failed fork no longer frees the parent's return stack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can only be triggered while ftrace function graph tracing is active. Function graph tracing is a debugging facility that must be explicitly enabled and is not active by default, so systems that do not use it are not exposed to this flaw. On systems where function graph tracing has been enabled, disabling it (for example, by selecting the 'nop' tracer through tracefs) prevents this flaw from being triggered. Otherwise, updating to a kernel version that contains the upstream fix is the complete remediation.