Description

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copy_exec_state() dup_task_struct() copies the parent's task_struct, including ret_stack. ftrace_graph_init_task() clears the copied function graph state, but it currently runs after copy_exec_state(). For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state. If that allocation fails, copy_process() reaches bad_fork_free and free_task() calls ftrace_graph_exit_task(). Since the child still carries the parent's ret_stack pointer, the unwind frees the parent's active function graph return stack. The parent subsequently accesses freed memory from function_graph_enter_regs(). KASAN reports: [ 22.190920] ================================================================== [ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs+0xa76/0xb90 [ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1 [ 22.205134] [ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g9328b3b03bdc-dirty #3 PREEMPT(lazy) [ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.213750] Call Trace: [ 22.215271] <TASK> [ 22.216242] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.217774] dump_stack_lvl+0x4e/0x70 [ 22.220531] print_report+0x157/0x4b4 [ 22.223202] ? fixup_red_left+0x9/0x30 [ 22.224407] ? complete_report_info+0x83/0x110 [ 22.226679] ? function_graph_enter_regs+0xa76/0xb90 [ 22.228084] kasan_report+0xce/0x100 [ 22.230109] ? function_graph_enter_regs+0xa76/0xb90 [ 22.232860] ? stack_trace_save+0x4/0xd0 [ 22.234156] function_graph_enter_regs+0xa76/0xb90 [ 22.236090] ? kasan_save_stack+0x30/0x50 [ 22.237752] ? __pfx_function_graph_enter_regs+0x10/0x10 [ 22.238694] ? ring_buffer_lock_reserve+0x345/0xf80 [ 22.239628] ? stack_trace_save+0x4/0xd0 [ 22.242121] ? stack_trace_save+0x4/0xd0 [ 22.243588] ftrace_graph_func+0xda/0x160 [ 22.245362] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.246520] 0xffffffffa0000095 [ 22.250528] ? stack_trace_save+0x9/0xd0 [ 22.251757] ? ring_buffer_unlock_commit+0x11d/0x5c0 [ 22.253152] stack_trace_save+0x9/0xd0 [ 22.254264] kasan_save_stack+0x30/0x50 [ 22.273631] kasan_save_track+0x14/0x30 [ 22.276763] kasan_save_free_info+0x3b/0x70 [ 22.278296] __kasan_slab_free+0x43/0x70 [ 22.280157] kmem_cache_free+0xbf/0x3b0 [ 22.282963] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.284001] free_task+0xa2/0x160 [ 22.285699] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.286752] copy_process+0x2aae/0x7bc0 Initialize the child function graph state immediately after dup_task_struct(), before the first fallible operation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:21.080Z",
  "pubdate": "2026-09-25T11:17:21.080Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Linux kernel's ftrace subsystem related to task process forking.\nThe vulnerability stems from improper initialization ordering of the function graph state during the execution of copy_process().\nAn attacker capable of triggering a fork operation that fails during a specific window can induce the kernel to free memory currently in use by a parent task.\nThis vulnerability can lead to kernel-level memory corruption, potential privilege escalation, or system instability/denial-of-service.\nThe flaw affects systems where ftrace function graph tracing is active.\nSuccessful exploitation requires the ability to execute code that triggers task creation while the kernel is in a specific state, although it does not require authentication beyond the ability to spawn processes.\nThe risk is categorized as high, as it impacts core kernel memory management and subsystem synchronization.",
  "technicalDetails": "The root cause of this vulnerability is an incorrect sequence of operations within the fork process lifecycle in the Linux kernel. When a new process is created, dup_task_struct() is invoked to copy the parent's task_struct to the child process. This structure includes the ret_stack pointer, which tracks the function graph return stack for tracing purposes.\nThe vulnerability occurs because ftrace_graph_init_task(), which is responsible for clearing the function graph state for the child task, is invoked after the copy_exec_state() function. If copy_exec_state() fails—specifically during non-CLONE_VM forks where a new task_exec_state is allocated—the process execution enters an error handling path known as bad_fork_free().\nDuring the execution of bad_fork_free(), the kernel calls free_task(), which in turn executes ftrace_graph_exit_task(). Because the child task was not properly initialized via ftrace_graph_init_task() prior to this point, the child task still holds a reference (the ret_stack pointer) to the parent's active function graph return stack. Consequently, ftrace_graph_exit_task() incorrectly attempts to free the memory associated with the parent's return stack.\nOnce the parent's stack memory is freed, the parent process remains active and continues execution. When the parent eventually triggers a function graph event, it reaches the function_graph_enter_regs() function. This function attempts to write to the already-freed memory location, resulting in a slab-use-after-free error, as confirmed by KASAN reports.\nThe exploitation flow is as follows: 1) The attacker initiates a process fork. 2) The system reaches a point where copy_exec_state() is called but fails due to memory constraints or other resource limitations. 3) The kernel's error handling path triggers a premature cleanup of the parent's ftrace state via the child's context. 4) The parent process resumes, leading to a write operation on the now-dangling pointer. This leads to arbitrary kernel memory corruption, which an attacker can leverage for local privilege escalation or to bypass security controls by corrupting adjacent kernel objects."
}