CVE-2026-89749

tracing: Fix crash passing ERR_PTR to kthread_stop()

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix crash passing ERR_PTR to kthread_stop()

event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel.

Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before c1a4fb7aa290f158d50654d640292e49d9055fd1Affected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 42ccb215ef0a552acbbd32f81009bfe4b278ba77Affected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 98d06fb9865a490e12ebe32d65b9ffac6108614dAffected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before ceb1707aef5824cf024eb82d10787b7621e2ff35Affected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 12a499f741fc5be3731c8b0a0d909406575cc2ebAffected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before adadf4192f700bca82abfda9fa6d58c0bf37cc04Affected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before c40e0b4fa365969e67011529eabdfb66d1022256Affected e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 649bc7df3e5d7be6f7996a95084037dbf3cad1e5Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before c1a4fb7aa290f158d50654d640292e49d9055fd1Affected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 42ccb215ef0a552acbbd32f81009bfe4b278ba77Affected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 98d06fb9865a490e12ebe32d65b9ffac6108614dAffected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before ceb1707aef5824cf024eb82d10787b7621e2ff35Affected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 12a499f741fc5be3731c8b0a0d909406575cc2ebAffected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before adadf4192f700bca82abfda9fa6d58c0bf37cc04Affected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before c40e0b4fa365969e67011529eabdfb66d1022256Affected
e6187007d6c365b551c69ea3df46f06fd1c8bd19 to before 649bc7df3e5d7be6f7996a95084037dbf3cad1e5Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.