In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails:
register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ...
If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer:
is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Therefore, when ftrace_startup_enable fails, we need to rollback registration process and remove ops from ftrace_ops_list.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bpftoolUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade kernelUpgrade perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-docUpgrade kernel-debugUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-headers | Jul 31, 2025 | Jul 28, 2025 |
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.10.144-127.601Upgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.294-220.533Upgrade bpftoolUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Jun 20, 2025 | Jun 20, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Oct 24, 2025 | Oct 23, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 30, 2025 | Jun 18, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Jun 18, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debugUpgrade kernel-cross-headersUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-toolsUpgrade kernel-rt-kvmUpgrade kernel-rtUpgrade python3-perfUpgrade bpftoolUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-debugUpgrade kernel-rt-modulesUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-debuginfoUpgrade perf | Feb 5, 2026 | Sep 8, 2025 |
| Ubuntu | — | Upgrade linux-lowlatencyUpgrade linux-raspiUpgrade linux-aws-hweUpgrade linux-intel-iotgUpgrade linux-hwe-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-iotUpgrade linux-realtimeUpgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linux-awsUpgrade linux-azureUpgrade linux-aws-5.15Upgrade linux-kvmUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-gcp-5.15Upgrade linux-bluefieldUpgrade linux-azure-fipsUpgrade linux-oracle-5.15Upgrade linuxUpgrade linux-gcp-5.4Upgrade linux-gkeopUpgrade linux-azure-4.15Upgrade linux-azure-5.15Upgrade linux-hwe-5.4Upgrade linux-aws-fipsUpgrade linux-gcp-4.15Upgrade linux-ibmUpgrade linux-riscv-5.15Upgrade linux-gcp-fipsUpgrade linux-ibm-5.4Upgrade linux-gcpUpgrade linux-hweUpgrade linux-nvidiaUpgrade linux-fipsUpgrade linux-azure-5.4Upgrade linux-oracle | Jun 26, 2025 | Jun 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub