CVE-2026-90066
Last modified
CVE-2026-90066 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer.
Description
In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference. Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= e1067a07cfbc5a36abad3752fafe4c79e06db1bb, < 7a96b9f6d5ba23dbce66c8a4a242effd4c01a830; >= e1067a07cfbc5a36abad3752fafe4c79e06db1bb, < 98b7b2a29ae87937aa02ab9391543ef8c602cd94; >= e1067a07cfbc5a36abad3752fafe4c79e06db1bb, < 626614df9080d7052fbe24dc90b5434717ab7a9f; >= e1067a07cfbc5a36abad3752fafe4c79e06db1bb, < cf839636911d8313f3ecd098329fd0b96499e4cf; >= e1067a07cfbc5a36abad3752fafe4c79e06db1bb, < 6727b7618f49401acf373fa3ec5712e2ec52e5cf |
| Linux | Linux | 5.16 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-90066?
How severe is CVE-2026-90066?
How do I fix CVE-2026-90066?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90060In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90061In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90062In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2026-90063In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90064In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90065In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90067In the Linux kernel, the following vulnerability has been re…7.5
- CVE-2026-90068In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90069In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-9007Improper neutralization of input during web page generation …5.5
- CVE-2026-90070In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90071In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-90066?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST