CVE-2026-97937
Description
A flaw was found in the Linux kernel. During process creation when the Function Tracer (ftrace) graph functionality is active, a memory allocation failure can lead to the kernel prematurely releasing memory still referenced by the parent process. A local attacker could exploit this use-after-free flaw to crash the system, resulting in a Denial of Service (DoS), or potentially escalate privileges.
Statement
A MODERATE use-after-free flaw was found in the Linux kernel's function graph tracing (ftrace) subsystem. When function graph tracing is active, a failed memory allocation during the creation of a new process (a fork without CLONE_VM) can cause the cleanup path of the failed fork to free the parent's function graph return stack, which the child had inherited via dup_task_struct(). The parent process subsequently writes to that freed memory when entering traced functions, which can result in kernel memory corruption. A local unprivileged attacker could exploit this flaw to crash the system (denial of service) or, in the worst case, escalate privileges. Exploitation requires function graph tracing to be enabled and a memory allocation failure to occur at the right point during fork, which is why Red Hat rates the attack complexity as high (CVSS 7.0), while the CVE.org record scores the flaw 7.8 with low attack complexity.
Currently, only Red Hat Enterprise Linux 6 Extended Lifecycle Support is listed on this flaw and its affectedness is still being assessed. Red Hat Enterprise Linux 7, 8, 9, and 10, RHEL for Automotive, and OpenShift 4 and later are marked not affected because the vulnerable code is not present in those kernels. The upstream fix initializes the child's function graph state immediately after dup_task_struct(), before the first fallible operation, so a failed fork no longer frees the parent's return stack.
Mitigation
This flaw can only be triggered while ftrace function graph tracing is active. Function graph tracing is a debugging facility that must be explicitly enabled and is not active by default, so systems that do not use it are not exposed to this flaw. On systems where function graph tracing has been enabled, disabling it (for example, by selecting the 'nop' tracer through tracefs) prevents this flaw from being triggered. Otherwise, updating to a kernel version that contains the upstream fix is the complete remediation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
