Cloudanix VulnDB

CVE-2026-89749

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can make the system crash during startup when memory is low.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Unconditional passing of error pointer (such as ERR_PTR(-ENOMEM)) returned by kthread_run to kthread_stop causes invalid dereference and kernel crash in event_test_stuff during boot-time tracing self-test under memory pressure.

Why it matters to the business

Unexpected kernel crashes during system startup or self-tests lead to boot failures, downtime, and operational instability especially on memory-constrained systems.

How an attack unfolds

Memory pressure during kernel initialization causes kthread_run failure in the tracing self-test; the returned error pointer is passed directly to kthread_stop which dereferences it, triggering a crash without attacker interaction beyond inducing resource exhaustion.

How to fix it

Apply upstream kernel patch adding IS_ERR check on kthread_run result before kthread_stop and emitting WARN_ON on failure; rebuild and deploy fixed kernel image.

How to confirm the fix worked

Inspect kernel source for event_test_stuff to confirm conditional check on kthread_run return value and presence of WARN_ON; test boot under simulated memory pressure to verify no crash.

Typical attack path

  1. Induce memory pressure during boot
  2. Trigger tracing self-test path that calls kthread_run
  3. Allow kthread_run to return ERR_PTR
  4. Pass result to kthread_stop causing dereference crash

How to detect it

Review kernel boot and panic logs for entries referencing event_test_stuff, kthread_run, or kthread_stop failures; correlate with low-memory conditions at startup.

What your security team should do

  • Prioritize patching kernel on all affected systems within standard maintenance windows
  • Monitor boot logs for kthread-related panics
  • Consider disabling optional tracing self-tests if immediate update is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERR_PTR to kthread_stop() event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

Affected packages

Ecosystem Package Introduced Fixed