« Volver al listado

CVE-2026-89749

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix crash passing ERR_PTR to kthread_stop()

event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel.

Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89749",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "c1a4fb7aa290f158d50654d640292e49d9055fd1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "42ccb215ef0a552acbbd32f81009bfe4b278ba77",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "98d06fb9865a490e12ebe32d65b9ffac6108614d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "ceb1707aef5824cf024eb82d10787b7621e2ff35",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "12a499f741fc5be3731c8b0a0d909406575cc2eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "adadf4192f700bca82abfda9fa6d58c0bf37cc04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "c40e0b4fa365969e67011529eabdfb66d1022256",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6187007d6c365b551c69ea3df46f06fd1c8bd19",
              "lessThan": "649bc7df3e5d7be6f7996a95084037dbf3cad1e5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.31",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:20:05.757",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/12a499f741fc5be3731c8b0a0d909406575cc2eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/42ccb215ef0a552acbbd32f81009bfe4b278ba77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/649bc7df3e5d7be6f7996a95084037dbf3cad1e5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/98d06fb9865a490e12ebe32d65b9ffac6108614d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/adadf4192f700bca82abfda9fa6d58c0bf37cc04",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c1a4fb7aa290f158d50654d640292e49d9055fd1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c40e0b4fa365969e67011529eabdfb66d1022256",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ceb1707aef5824cf024eb82d10787b7621e2ff35",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix crash passing ERR_PTR to kthread_stop()\n\nevent_test_stuff() calls kthread_run() and unconditionally passes the\nreturned task_struct pointer to kthread_stop(). kthread_run() returns an\nerror pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for\nexample under memory pressure during the boot-time event self-test.\nkthread_stop() then dereferences the invalid pointer, crashing the kernel.\n\nCheck the result of kthread_run() before passing it to kthread_stop(). Use\nWARN_ON() so that a failure to create the self-test thread does not go\nunnoticed, matching the ring-buffer self-test fix in commit\n91542863abad (\"ring-buffer: Fix crash passing ERR_PTR to kthread_stop()\")."
    }
  ],
  "lastModified": "2026-09-14T13:19:23.513",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}