CVE-2026-97443
Description
A flaw was found in the Linux kernel's perf subsystem. During error handling for failed performance event allocation, the kernel unconditionally attempts to unregister a function tracer that was never successfully enabled. A local user can exploit this flaw to trigger a kernel warning, which may cause a system crash and Denial of Service (DoS) if the system is configured to panic on warnings.
Statement
A flaw of low impact was found in the Linux kernel's perf/ftrace subsystem. When perf_event_alloc() fails and its error cleanup path runs, perf_ftrace_function_unregister() unconditionally calls unregister_ftrace_function() without first checking whether the ftrace_ops was ever successfully registered, which triggers a WARN_ON in __unregister_ftrace_function(). A local user with the ability to open perf events can reach this error path and trigger the kernel warning. The consequence is limited to a kernel warning and taint: there is no impact on confidentiality or integrity, and a system crash / denial of service is only possible on systems explicitly configured to panic on warnings (panic_on_warn), which is not the default configuration. Red Hat therefore assesses the impact of this flaw as Low; the CVSS:3.1 base score of 5.5 (Moderate) reflects the worst-case availability scenario on panic-on-warnings systems rather than typical deployments.
The vulnerable behavior was introduced by the perf/core simplification of the perf_event_alloc() error path (upstream commit e1419f744ecd), so only recent kernel streams are affected: Red Hat Enterprise Linux 10 kernel streams rhel-10.2.z, rhel-10.3, and rhel-10.4, and the Red Hat In-Vehicle OS (RHIVOS) 2.x kernel streams, all of which currently have the fix deferred. RHEL 6, 7, 8, 9, and RHEL 10.0 kernels, as well as the OpenShift RHCOS kernels, do not contain the vulnerable code and are not affected. While the fix remains deferred on the affected streams, the residual risk is limited to a local user triggering a low-severity kernel warning.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
