CVE-2026-97443

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97443", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T14:53:16.870Z", "datePublished": "2026-09-24T16:03:57.790Z", "dateUpdated": "2026-09-25T12:44:20.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T12:44:20.881Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/ftrace: Fix WARNING in __unregister_ftrace_function\n\nperf_ftrace_function_unregister() unconditionally calls\nunregister_ftrace_function() without checking whether the ftrace_ops\nwas ever successfully registered. This triggers a WARN_ON in\n__unregister_ftrace_function() when the ops doesn't have\nFTRACE_OPS_FL_ENABLED set.\n\nThis can happen during perf_event_alloc() error cleanup when\nperf_trace_destroy() is called via __free_event() on an event whose\nftrace_ops registration failed or was already torn down by\nperf_try_init_event()'s err_destroy path.\n\nThe call path is:\n perf_event_alloc() error cleanup\n -> __free_event()\n -> event->destroy() [tp_perf_event_destroy]\n -> perf_trace_destroy()\n -> perf_trace_event_close()\n -> TRACE_REG_PERF_CLOSE\n -> perf_ftrace_function_unregister()\n -> unregister_ftrace_function()\n -> __unregister_ftrace_function()\n -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))\n\nFix this by checking FTRACE_OPS_FL_ENABLED before attempting to\nunregister. If the ops is not enabled, just free the filter and\nreturn success."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_event_perf.c"], "versions": [{"version": "7ef5aa081f989ecfecc1df02068a80aebbd3ec31", "lessThan": "df097713b56ffac5eed32a9be2e7d27ac48d9087", "status": "affected", "versionType": "git"}, {"version": "c70ca298036c58a88686ff388d3d367e9d21acf0", "lessThan": "7f845820afaad339341c2ae42bc7fdec175df9ea", "status": "affected", "versionType": "git"}, {"version": "c70ca298036c58a88686ff388d3d367e9d21acf0", "lessThan": "9581123304b23049437324038698af9fb56ee663", "status": "affected", "versionType": "git"}, {"version": "315a50c6b1c6ce191f19f3372935d8e2ed9b53a6", "status": "affected", "versionType": "git"}, {"version": "1209b0b29fd472e7dbd2b06544b019dd9f9b7e51", "status": "affected", "versionType": "git"}, {"version": "6.12.24", "lessThan": "6.12.111", "status": "affected", "versionType": "semver"}, {"version": "6.13.12", "lessThan": "6.14", "status": "affected", "versionType": "semver"}, {"version": "6.14.3", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_event_perf.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.24", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/df097713b56ffac5eed32a9be2e7d27ac48d9087"}, {"url": "https://git.kernel.org/stable/c/7f845820afaad339341c2ae42bc7fdec175df9ea"}, {"url": "https://git.kernel.org/stable/c/9581123304b23049437324038698af9fb56ee663"}], "title": "perf/ftrace: Fix WARNING in __unregister_ftrace_function", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace_event_perf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "df097713b56ffac5eed32a9be2e7d27ac48d9087", "status": "affected", "version": "7ef5aa081f989ecfecc1df02068a80aebbd3ec31", "versionType": "git"}, {"lessThan": "7f845820afaad339341c2ae42bc7fdec175df9ea", "status": "affected", "version": "c70ca298036c58a88686ff388d3d367e9d21acf0", "versionType": "git"}, {"lessThan": "9581123304b23049437324038698af9fb56ee663", "status": "affected", "version": "c70ca298036c58a88686ff388d3d367e9d21acf0", "versionType": "git"}, {"status": "affected", "version": "315a50c6b1c6ce191f19f3372935d8e2ed9b53a6", "versionType": "git"}, {"status": "affected", "version": "1209b0b29fd472e7dbd2b06544b019dd9f9b7e51", "versionType": "git"}, {"lessThan": "6.12.111", "status": "affected", "version": "6.12.24", "versionType": "semver"}, {"lessThan": "6.14", "status": "affected", "version": "6.13.12", "versionType": "semver"}, {"lessThan": "6.15", "status": "affected", "version": "6.14.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace_event_perf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/ftrace: Fix WARNING in __unregister_ftrace_function\n\nperf_ftrace_function_unregister() unconditionally calls\nunregister_ftrace_function() without checking whether the ftrace_ops\nwas ever successfully registered. This triggers a WARN_ON in\n__unregister_ftrace_function() when the ops doesn't have\nFTRACE_OPS_FL_ENABLED set.\n\nThis can happen during perf_event_alloc() error cleanup when\nperf_trace_destroy() is called via __free_event() on an event whose\nftrace_ops registration failed or was already torn down by\nperf_try_init_event()'s err_destroy path.\n\nThe call path is:\n perf_event_alloc() error cleanup\n -> __free_event()\n -> event->destroy() [tp_perf_event_destroy]\n -> perf_trace_destroy()\n -> perf_trace_event_close()\n -> TRACE_REG_PERF_CLOSE\n -> perf_ftrace_function_unregister()\n -> unregister_ftrace_function()\n -> __unregister_ftrace_function()\n -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))\n\nFix this by checking FTRACE_OPS_FL_ENABLED before attempting to\nunregister. If the ops is not enabled, just free the filter and\nreturn success."}], "id": "CVE-2026-97443", "lastModified": "2026-09-25T13:17:28.023", "metrics": {}, "published": "2026-09-24T17:17:22.550", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f845820afaad339341c2ae42bc7fdec175df9ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9581123304b23049437324038698af9fb56ee663"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df097713b56ffac5eed32a9be2e7d27ac48d9087"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: perf/ftrace: Fix WARNING in __unregister_ftrace_function", "id": "2540498", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540498"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nperf/ftrace: Fix WARNING in __unregister_ftrace_function\nperf_ftrace_function_unregister() unconditionally calls\nunregister_ftrace_function() without checking whether the ftrace_ops\nwas ever successfully registered. This triggers a WARN_ON in\n__unregister_ftrace_function() when the ops doesn't have\nFTRACE_OPS_FL_ENABLED set.\nThis can happen during perf_event_alloc() error cleanup when\nperf_trace_destroy() is called via __free_event() on an event whose\nftrace_ops registration failed or was already torn down by\nperf_try_init_event()'s err_destroy path.\nThe call path is:\nperf_event_alloc() error cleanup\n-> __free_event()\n-> event->destroy() [tp_perf_event_destroy]\n-> perf_trace_destroy()\n-> perf_trace_event_close()\n-> TRACE_REG_PERF_CLOSE\n-> perf_ftrace_function_unregister()\n-> unregister_ftrace_function()\n-> __unregister_ftrace_function()\n-> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))\nFix this by checking FTRACE_OPS_FL_ENABLED before attempting to\nunregister. If the ops is not enabled, just free the filter and\nreturn success.", "A flaw was found in the Linux kernel's perf subsystem. During error handling for failed performance event allocation, the kernel unconditionally attempts to unregister a function tracer that was never successfully enabled. A local user can exploit this flaw to trigger a kernel warning, which may cause a system crash and Denial of Service (DoS) if the system is configured to panic on warnings."], "name": "CVE-2026-97443", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97443\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97443\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97443.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,df097713b56ffac5eed32a9be2e7d27ac48d9087)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7f845820afaad339341c2ae42bc7fdec175df9ea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9581123304b23049437324038698af9fb56ee663)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T00:15:13.675266+00:00", "updated": "2026-10-01T17:15:10.303985+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}