In the Linux kernel, the following vulnerability has been resolved:
tracing: Take trace_array reference when opening options file
The options files do not take the trace_array reference for the options
they represent. This could cause a use-after-free kernel crash if one of
these files is opened by one task and another task removes the instance
that the option is for. Because it doesn't take a reference upon opening,
it will not stop the removal which will free the options descriptor that
is being used.
As the options are somewhat dynamic in their creation at boot up, each
file represents a flag in the trace_array. The trace_array has an array of
indexes to represent each of these flags that is stored in the
trace_flags_index array. The address of the index array element is used to
pass to the inode->i_private pointer. Then that element is read which
holds the index (which represents the flag) and then the index is used to
calculate the trace_array descriptor from its trace_flags_index array.
One issue is that the index element can not be referenced until the
trace_array's reference is taken. To handle this, create a new helper
function called: trace_array_options_get() that will iterate all the
existing trace_arrays in the ftrace_trace_arrays list (under the
trace_types_lock), and compare the passed in address of the index element
with the entire array of the trace_array's trace_flags_index array.
If it matches, then up the corresponding trace_array's reference and
return.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The UAF is reached only via local tracefs: open() of an instance options file (tracing_open_generic -> trace_options_core_read/write) then rmdir of that instance (__remove_instance). No network, adjacent-radio, or physical-device path reaches get_tr_index() or the freed trace_array.
AC:L - The attacker fully controls both sides: open an instance options file (no trace_array ref), rmdir the instance so __remove_instance kfree()s the trace_array, then read/write the still-open fd. That sequence is deterministic and retryable; CONFIG_TRACING with instances is standard, not a rare config.
PR:L - tracing_open_generic() and instance mkdir/rmdir enforce only LOCKDOWN_TRACEFS and DAC (options 0640, dirs 0750) with no capable() gate. Android/Perfetto, ChromeOS, and gid=/uid= tracing mounts routinely delegate this to unprivileged tracing accounts, matching CVE-2026-74606 and CVE-2026-89747.
UI:N - The attacker mkdir()s their own tracing instance, opens options, rmdir()s the instance, and reads or writes the fd themselves. No victim mount, click, or cooperating process is required.
S:U - The use-after-free corrupts a kernel trace_array in the tracing subsystem on the same host. It can yield local privilege escalation but does not cross a VM, IOMMU, or other security authority.
C:H - After rmdir, get_tr_index() reads the freed trace_flags_index byte and reconstructs a trace_array, then trace_options_core_read() loads tr->trace_flags. Reclaiming that slab lets the attacker control the object and obtain an arbitrary kernel read, which kernel CNA guidance scores High for UAF.
I:H - trace_options_core_write() calls set_tracer_flag() on the freed/reused trace_array, including tr->current_trace->flag_changed and writes to tr->trace_flags and related tracing state. Heap spraying that object yields an arbitrary kernel write and control-flow hijack primitive.
A:H - Dereferencing the kfree()d trace_array in get_tr_index()/trace_options_core_read() oopses or panics the kernel, which the fix describes as a use-after-free kernel crash. The attacker can retrigger that crash at will.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The UAF is reached only via local tracefs: open() of an instance options file (tracing_open_generic -> trace_options_core_read/write) then rmdir of that instance (__remove_instance). No network, adjacent-radio, or physical-device path reaches get_tr_index() or the freed trace_array.
AC:L - The attacker fully controls both sides: open an instance options file (no trace_array ref), rmdir the instance so __remove_instance kfree()s the trace_array, then read/write the still-open fd. That sequence is deterministic and retryable; CONFIG_TRACING with instances is standard, not a rare config.
PR:L - tracing_open_generic() and instance mkdir/rmdir enforce only LOCKDOWN_TRACEFS and DAC (options 0640, dirs 0750) with no capable() gate. Android/Perfetto, ChromeOS, and gid=/uid= tracing mounts routinely delegate this to unprivileged tracing accounts, matching CVE-2026-74606 and CVE-2026-89747.
UI:N - The attacker mkdir()s their own tracing instance, opens options, rmdir()s the instance, and reads or writes the fd themselves. No victim mount, click, or cooperating process is required.
S:U - The use-after-free corrupts a kernel trace_array in the tracing subsystem on the same host. It can yield local privilege escalation but does not cross a VM, IOMMU, or other security authority.
C:H - After rmdir, get_tr_index() reads the freed trace_flags_index byte and reconstructs a trace_array, then trace_options_core_read() loads tr->trace_flags. Reclaiming that slab lets the attacker control the object and obtain an arbitrary kernel read, which kernel CNA guidance scores High for UAF.
I:H - trace_options_core_write() calls set_tracer_flag() on the freed/reused trace_array, including tr->current_trace->flag_changed and writes to tr->trace_flags and related tracing state. Heap spraying that object yields an arbitrary kernel write and control-flow hijack primitive.
A:H - Dereferencing the kfree()d trace_array in get_tr_index()/trace_options_core_read() oopses or panics the kernel, which the fix describes as a use-after-free kernel crash. The attacker can retrigger that crash at will.
CVSS 3.1