CVE-2026-89749
Description
A flaw was found in the Linux kernel. Specifically, within the tracing subsystem, the event_test_stuff() function can pass an invalid error pointer to kthread_stop() if kthread_run() fails to create a kernel thread. This improper handling of error pointers, particularly under memory pressure, leads to kthread_stop() attempting to dereference an invalid memory address. The consequence of this vulnerability is a kernel crash, resulting in a denial of service for the affected system.
Statement
A low impact flaw was found in the Linux kernel's tracing subsystem, affecting the kernel as shipped in Red Hat products. In the event self-test helper event_test_stuff(), the task_struct pointer returned by kthread_run() is unconditionally passed to kthread_stop(). When creation of the kernel thread fails, for example under memory pressure during the boot-time event self-test, kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM), and kthread_stop() dereferences that invalid pointer, crashing the kernel. The consequence is a kernel panic and denial of service; there is no impact on confidentiality or integrity. The flaw is rated low impact by Red Hat, with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat products that include the affected kernel code are recorded as affected, but the fix is deferred because the flaw's severity falls below the threshold at which Red Hat schedules fixes. The residual risk is a kernel crash that can occur only when the boot-time tracing event self-test runs and kernel thread creation fails, for example under memory pressure.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
