Answer in brief
CVE-2026-90002 records a High severity (CVSS 7.8) vulnerability in ftrace: Take trace_array reference before accessing its ftrace_ops. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=591dffdade9f07692a7dd3ed16830ec24e901ece <177cd8966325f0ffffa3c9381f9e0422019a3973 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <83fd7eca5ab0d3ac3f23bff889175d847e21af06 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <cee8f286794df916553d8d445eac5c323ec5b0f8 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <9100191e5acb2e5ea2313f436667bb5fce129f47 | 177cd8966325f0ffffa3c9381f9e0422019a3973, 83fd7eca5ab0d3ac3f23bff889175d847e21af06, cee8f286794df916553d8d445eac5c323ec5b0f8, 9100191e5acb2e5ea2313f436667bb5fce129f47 |
| Linux/Linuxgeneric | 3.15 | Not reported |
| Linux/Linuxgeneric | >=591dffdade9f07692a7dd3ed16830ec24e901ece <83fd7eca5ab0d3ac3f23bff889175d847e21af06 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <cee8f286794df916553d8d445eac5c323ec5b0f8 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <9100191e5acb2e5ea2313f436667bb5fce129f47 | 83fd7eca5ab0d3ac3f23bff889175d847e21af06, cee8f286794df916553d8d445eac5c323ec5b0f8, 9100191e5acb2e5ea2313f436667bb5fce129f47 |
| Linux/Linuxgeneric | >=591dffdade9f07692a7dd3ed16830ec24e901ece <29266da8ee1d9be656b1f22460c49538e1930658 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <177cd8966325f0ffffa3c9381f9e0422019a3973 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <83fd7eca5ab0d3ac3f23bff889175d847e21af06 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <cee8f286794df916553d8d445eac5c323ec5b0f8 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <9100191e5acb2e5ea2313f436667bb5fce129f47 | 29266da8ee1d9be656b1f22460c49538e1930658, 177cd8966325f0ffffa3c9381f9e0422019a3973, 83fd7eca5ab0d3ac3f23bff889175d847e21af06, cee8f286794df916553d8d445eac5c323ec5b0f8, 9100191e5acb2e5ea2313f436667bb5fce129f47 |
| Linux/Linuxgeneric | >=591dffdade9f07692a7dd3ed16830ec24e901ece <0124b36a7eac1dd0402146fc6c1f732877b9cd9f || >=591dffdade9f07692a7dd3ed16830ec24e901ece <ffe16fe221e25cd1915602e6753c3d3285ed9a98 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <8f062a6bfeb4b4e18d469a673aec23a7b73c3e8a || >=591dffdade9f07692a7dd3ed16830ec24e901ece <29266da8ee1d9be656b1f22460c49538e1930658 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <177cd8966325f0ffffa3c9381f9e0422019a3973 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <83fd7eca5ab0d3ac3f23bff889175d847e21af06 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <cee8f286794df916553d8d445eac5c323ec5b0f8 || >=591dffdade9f07692a7dd3ed16830ec24e901ece <9100191e5acb2e5ea2313f436667bb5fce129f47 | 0124b36a7eac1dd0402146fc6c1f732877b9cd9f, ffe16fe221e25cd1915602e6753c3d3285ed9a98, 8f062a6bfeb4b4e18d469a673aec23a7b73c3e8a, 29266da8ee1d9be656b1f22460c49538e1930658, 177cd8966325f0ffffa3c9381f9e0422019a3973, 83fd7eca5ab0d3ac3f23bff889175d847e21af06, cee8f286794df916553d8d445eac5c323ec5b0f8, 9100191e5acb2e5ea2313f436667bb5fce129f47 |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->private pointer to get a reference to the trace_array and then take its reference. The problem is that the ftrace_ops itself could be freed. If the rmdir on the instance happens at the same time the set_ftrace_filter file is opened, the rmdir could have also freed the ftrace_ops and referencing it will cause a use-after-free bug and crash the kernel. Instead, pass in the trace_array as the file private data (NULL for the top level instance), and then pass both the trace_array and the ftrace_ops to the ftrace_regex_open() function. If the trace_array is NULL, then it just uses the ftrace_ops without the need to take its reference (like normal). If the ftrace_ops is NULL, that is only the case for the top level instance and the global_ops can be used. This allows the trace_array to have its reference incremented before touching the ftrace_ops that could also be freed when the instance is.
Quoted source text, attributed separately from HOL analysis.