OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-90014

HIGH · CVSS 7.8 EPSS 0.17%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's tracing subsystem, specifically the show_event_filters and show_event_triggers files, which do not properly manage references to the trace array. This oversight can lead to a use-after-free condition, potentially causing system crashes when a task attempts to read from these files while the trace array is being freed. Organizations utilizing Linux kernel versions that include this tracing functionality should prioritize this issue to prevent instability and ensure system reliability.

CVE
CVE-2026-90014
Severity
HIGH
CVSS
7.8
EPSS
0.17%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Have show_event_filters/triggers files take trace array ref The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (trace_array) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash. Have the open of both those files take the trace_array reference via the trace_array_get() that prevents the trace_array from being freed while the files are opened.