CVE-2026-89749 tracing: Fix crash passing ERR_PTR to kthread_stop()
A local attacker can trigger a kernel crash by inducing memory pressure during boot-time tracing self-tests, causing a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89749?
CVE-2026-89749 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix crash passing ERR_PTR to kthread_stop()
event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel.
Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").
Which versions are affected by CVE-2026-89749?
How do I fix CVE-2026-89749?
Apply the vendor's patch.
Is CVE-2026-89749 being exploited?
There is no known exploitation of CVE-2026-89749 in the wild and no public exploit code.
Sources
Also known as AZL-100491, BELL-CVE-2026-89749, DEBIAN-CVE-2026-89749, GHSA-hwhc-m4xq-f4r2, UBUNTU-CVE-2026-89749.