{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97937 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97937 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97937 and fix it if it is affected.\n\nWhat it is: CVE-2026-97937 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97937 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97937/ (Markdown: https://insights.sbomify.com/CVE-2026-97937/index.md)","id":"CVE-2026-97937","markdown":"https://insights.sbomify.com/CVE-2026-97937/index.md","name":"CVE-2026-97937","record":{"aliases":["DEBIAN-CVE-2026-97937","GHSA-79j5-369g-hx4m","UBUNTU-CVE-2026-97937"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel ftrace subsystem allows local attackers to execute arbitrary code or escalate privileges via a race condition during fork.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: fork: Initialize function graph state before copy_exec_state()\n\ndup_task_struct() copies the parent's task_struct, including ret_stack.\nftrace_graph_init_task() clears the copied function graph state, but it\ncurrently runs after copy_exec_state().\n\nFor non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.\nIf that allocation fails, copy_process() reaches bad_fork_free and\nfree_task() calls ftrace_graph_exit_task(). Since the child still carries\nthe parent's ret_stack pointer, the unwind frees the parent's active\nfunction graph return stack. The parent subsequently accesses freed memory\nfrom function_graph_enter_regs().\n\nKASAN reports:\n\n[   22.190920] ==================================================================\n[   22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90\n[   22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1\n[   22.205134]\n[   22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy)\n[   22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   22.213750] Call Trace:\n[   22.215271]  \u003cTASK\u003e\n[   22.216242]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.217774]  dump_stack_lvl+0x4e/0x70\n[   22.220531]  print_report+0x157/0x4b4\n[   22.223202]  ? fixup_red_left+0x9/0x30\n[   22.224407]  ? complete_report_info+0x83/0x110\n[   22.226679]  ? function_graph_enter_regs+0xa76/0xb90\n[   22.228084]  kasan_report+0xce/0x100\n[   22.230109]  ? function_graph_enter_regs+0xa76/0xb90\n[   22.232860]  ? stack_trace_save+0x4/0xd0\n[   22.234156]  function_graph_enter_regs+0xa76/0xb90\n[   22.236090]  ? kasan_save_stack+0x30/0x50\n[   22.237752]  ? __pfx_function_graph_enter_regs+0x10/0x10\n[   22.238694]  ? ring_buffer_lock_reserve+0x345/0xf80\n[   22.239628]  ? stack_trace_save+0x4/0xd0\n[   22.242121]  ? stack_trace_save+0x4/0xd0\n[   22.243588]  ftrace_graph_func+0xda/0x160\n[   22.245362]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.246520]  0xffffffffa0000095\n[   22.250528]  ? stack_trace_save+0x9/0xd0\n[   22.251757]  ? ring_buffer_unlock_commit+0x11d/0x5c0\n[   22.253152]  stack_trace_save+0x9/0xd0\n[   22.254264]  kasan_save_stack+0x30/0x50\n[   22.273631]  kasan_save_track+0x14/0x30\n[   22.276763]  kasan_save_free_info+0x3b/0x70\n[   22.278296]  __kasan_slab_free+0x43/0x70\n[   22.280157]  kmem_cache_free+0xbf/0x3b0\n[   22.282963]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.284001]  free_task+0xa2/0x160\n[   22.285699]  ? ftrace_stub_direct_tramp+0x10/0x10\n[   22.286752]  copy_process+0x2aae/0x7bc0\n\nInitialize the child function graph state immediately after\ndup_task_struct(), before the first fallible operation.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ftrace: fork: Initialize function graph state before copy_exec_state()","id":"CVE-2026-97937","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"reboot: fix cad_pid use-after-free race","id":"CVE-2026-97938"},"packages":[],"prev":{"headline":"tracing: Fix memory corruption from the histogram stacktrace modifier","id":"CVE-2026-97936"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel ftrace subsystem allows local attackers to execute arbitrary code or escalate privileges via a race condition during fork.","url":"https://insights.sbomify.com/CVE-2026-97937/"}