In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails:
register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ...
If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer:
is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Therefore, when ftrace_startup_enable fails, we need to rollback registration process and remove ops from ftrace_ops_list.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-docUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-coreUpgrade kernel-cross-headersUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-modulesUpgrade bpftoolUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt | Jul 31, 2025 | Jul 28, 2025 |
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-toolsUpgrade python-perfUpgrade perfUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.69-37.134Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.144-127.601Upgrade bpftoolUpgrade kernel-livepatch-4.14.294-220.533Upgrade python-perf-debuginfoUpgrade kernel-tools-devel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Jun 20, 2025 | Jun 20, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftool | Oct 24, 2025 | Oct 23, 2025 |
| Oracle_linux | — | Upgrade kernel | Jul 30, 2025 | Jun 18, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Jun 18, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernel-rt-debug-debuginfoUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-cross-headersUpgrade kernel-rtUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-toolsUpgrade kernel-rt-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-core | Feb 5, 2026 | Sep 8, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.4Upgrade linux-ibmUpgrade linux-azure-5.4Upgrade linux-gcp-5.4Upgrade linux-fipsUpgrade linux-azure-fipsUpgrade linux-hweUpgrade linux-ibm-5.4Upgrade linux-azure-4.15Upgrade linux-azure-fde-5.15Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-gcpUpgrade linuxUpgrade linux-gcp-fipsUpgrade linux-gcp-4.15Upgrade linux-nvidiaUpgrade linux-gkeopUpgrade linux-riscv-5.15Upgrade linux-oracle-5.15Upgrade linux-aws-fipsUpgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-awsUpgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-raspi-5.4Upgrade linux-hwe-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-bluefieldUpgrade linux-azureUpgrade linux-intel-iotgUpgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-gcp-5.15Upgrade linux-aws-5.4Upgrade linux-iotUpgrade linux-kvmUpgrade linux-realtimeUpgrade linux-gke | Jun 26, 2025 | Jun 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub