CVE-2026-23138

What it actually does

Missing recursion guards in kernel stack trace recording allow ftrace events to re-enter RCU paths, producing unbounded recursion when RCU tracepoints are enabled alongside stack-trace triggers.

Why it matters to the business

Unprivileged local users can trigger kernel stack overflows that crash or hang the system, causing denial of service and unplanned downtime on any Linux host running an affected kernel.

How an attack unfolds

An attacker with local access enables the kernel stack-trace trigger on RCU events; the resulting trace call recurses back into RCU, exhausting the stack and crashing the kernel. The flaw exists only in the tracing side; the separate RCU fix is not addressed here.

How to fix it

Upgrade the Linux kernel to the commit 5b7f91acffd2c4c000971553d22efa1e1bb4feae or later stable releases that contain the expanded ftrace recursion-protection bits for interrupt context.

How to confirm the fix worked

Confirm the running kernel contains commit 5b7f91acffd2c4c000971553d22efa1e1bb4feae, or verify that stack-trace triggers no longer cause recursion when RCU tracepoints are enabled.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Load or enable ftrace with the stack-trace trigger attached to RCU tracepoints
3. Trigger RCU events to initiate the recursive trace path
4. Observe kernel stack overflow and system crash or hang

How to detect it

Review kernel logs for repeated stack-trace entries or RCU recursion warnings immediately before a crash; examine ftrace and perf configurations for stack-trace triggers on RCU events.

What your security team should do

• Prioritize kernel updates on all systems that enable ftrace or perf tracing
• Temporarily disable stack-trace triggers on RCU events until patches are applied
• Monitor EPSS trend and any new exploit maturity signals for increased urgency