In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails:
register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ...
If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer:
is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Therefore, when ftrace_startup_enable fails, we need to rollback registration process and remove ops from ftrace_ops_list.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-develUpgrade python3-perfUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debugUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-core | Jul 31, 2025 | Jul 28, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.144-127.601Upgrade kernelUpgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-livepatch-4.14.294-220.533Upgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Jun 20, 2025 | Jun 20, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libs | Oct 24, 2025 | Oct 23, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 30, 2025 | Jun 18, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 9, 2025 | Jun 18, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfoUpgrade kernel-rt-kvmUpgrade perfUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-debug-develUpgrade bpftool-debuginfoUpgrade kernel-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfoUpgrade kernel-rt-core | Feb 5, 2026 | Sep 8, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.4Upgrade linux-azure-fde-5.15Upgrade linux-gcp-4.15Upgrade linux-ibm-5.4Upgrade linux-ibmUpgrade linux-gcpUpgrade linux-gcp-5.4Upgrade linux-fipsUpgrade linux-aws-fipsUpgrade linux-azure-5.4Upgrade linux-gcp-fipsUpgrade linux-nvidiaUpgrade linux-azure-fipsUpgrade linux-azure-4.15Upgrade linux-azure-5.15Upgrade linux-riscv-5.15Upgrade linux-gkeopUpgrade linuxUpgrade linux-hweUpgrade linux-oracle-5.15Upgrade linux-oracleUpgrade linux-oracle-5.4Upgrade linux-gkeUpgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-azureUpgrade linux-aws-5.15Upgrade linux-aws-5.4Upgrade linux-awsUpgrade linux-raspi-5.4Upgrade linux-aws-hweUpgrade linux-kvmUpgrade linux-gcp-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-realtimeUpgrade linux-bluefieldUpgrade linux-lowlatencyUpgrade linux-hwe-5.15Upgrade linux-iot | Jun 26, 2025 | Jun 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub