CVE-2026-90066

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference.

Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 02866f063062dcc5686445c738be003de9787250Affected e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 7a96b9f6d5ba23dbce66c8a4a242effd4c01a830Affected e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 98b7b2a29ae87937aa02ab9391543ef8c602cd94Affected e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 626614df9080d7052fbe24dc90b5434717ab7a9fAffected e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before cf839636911d8313f3ecd098329fd0b96499e4cfAffected e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 6727b7618f49401acf373fa3ec5712e2ec52e5cfAffected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.191 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 02866f063062dcc5686445c738be003de9787250Affected
e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 7a96b9f6d5ba23dbce66c8a4a242effd4c01a830Affected
e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 98b7b2a29ae87937aa02ab9391543ef8c602cd94Affected
e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 626614df9080d7052fbe24dc90b5434717ab7a9fAffected
e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before cf839636911d8313f3ecd098329fd0b96499e4cfAffected
e1067a07cfbc5a36abad3752fafe4c79e06db1bb to before 6727b7618f49401acf373fa3ec5712e2ec52e5cfAffected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.191 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.