{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90002 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90002 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90002 and fix it if it is affected.\n\nWhat it is: CVE-2026-90002 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90002 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90002/ (Markdown: https://insights.sbomify.com/CVE-2026-90002/index.md)","id":"CVE-2026-90002","markdown":"https://insights.sbomify.com/CVE-2026-90002/index.md","name":"CVE-2026-90002","record":{"aliases":["AZL-101693","BELL-CVE-2026-90002","DEBIAN-CVE-2026-90002","GHSA-hxw4-9m57-prf4","UBUNTU-CVE-2026-90002"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A race condition in the Linux kernel ftrace subsystem allows a use-after-free, leading to a kernel crash and denial of service.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Take trace_array reference before accessing its ftrace_ops\n\nThe trace instance files set_ftrace_filter and set_ftrace_notrace was\nupdated to work with specific trace instances (trace_arrays). The issue is\nthat when these files are opened, there is a small race window where it\nwill use the ftrace_ops from the inode-\u003eprivate pointer to get a reference\nto the trace_array and then take its reference. The problem is that the\nftrace_ops itself could be freed. If the rmdir on the instance happens at\nthe same time the set_ftrace_filter file is opened, the rmdir could have\nalso freed the ftrace_ops and referencing it will cause a use-after-free\nbug and crash the kernel.\n\nInstead, pass in the trace_array as the file private data (NULL for the\ntop level instance), and then pass both the trace_array and the ftrace_ops\nto the ftrace_regex_open() function. If the trace_array is NULL, then it\njust uses the ftrace_ops without the need to take its reference (like\nnormal). If the ftrace_ops is NULL, that is only the case for the top\nlevel instance and the global_ops can be used.\n\nThis allows the trace_array to have its reference incremented before\ntouching the ftrace_ops that could also be freed when the instance is.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ftrace: Take trace_array reference before accessing its ftrace_ops","id":"CVE-2026-90002","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"futex: Prevent rcuwait use-after-free during requeue PI","id":"CVE-2026-90003"},"packages":[],"prev":{"headline":"HID: bpf: serialize device reference release in struct_ops destroy path","id":"CVE-2026-90001"},"products":["Linux"],"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A race condition in the Linux kernel ftrace subsystem allows a use-after-free, leading to a kernel crash and denial of service.","url":"https://insights.sbomify.com/CVE-2026-90002/"}