{"id":"CVE-2026-89749","title":"tracing: Fix crash passing ERR_PTR to kthread_stop()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix crash passing ERR_PTR to kthread_stop()\n\nevent_test_stuff() calls kthread_run() and unconditionally passes the\nreturned task_struct pointer to kthread_stop…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-476"],"vendor":"Linux","product":"Linux","affected":["Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < c1a4fb7aa290f158d50654d640292e49d9055fd1","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 42ccb215ef0a552acbbd32f81009bfe4b278ba77","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 98d06fb9865a490e12ebe32d65b9ffac6108614d","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < ceb1707aef5824cf024eb82d10787b7621e2ff35","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 12a499f741fc5be3731c8b0a0d909406575cc2eb","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < adadf4192f700bca82abfda9fa6d58c0bf37cc04","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < c40e0b4fa365969e67011529eabdfb66d1022256","Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 649bc7df3e5d7be6f7996a95084037dbf3cad1e5","Linux 2.6.31"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:52:03.128Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89749","references":[{"url":"https://git.kernel.org/stable/c/c1a4fb7aa290f158d50654d640292e49d9055fd1"},{"url":"https://git.kernel.org/stable/c/42ccb215ef0a552acbbd32f81009bfe4b278ba77"},{"url":"https://git.kernel.org/stable/c/98d06fb9865a490e12ebe32d65b9ffac6108614d"},{"url":"https://git.kernel.org/stable/c/ceb1707aef5824cf024eb82d10787b7621e2ff35"},{"url":"https://git.kernel.org/stable/c/12a499f741fc5be3731c8b0a0d909406575cc2eb"},{"url":"https://git.kernel.org/stable/c/adadf4192f700bca82abfda9fa6d58c0bf37cc04"},{"url":"https://git.kernel.org/stable/c/c40e0b4fa365969e67011529eabdfb66d1022256"},{"url":"https://git.kernel.org/stable/c/649bc7df3e5d7be6f7996a95084037dbf3cad1e5"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89749.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89749"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532518"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89749"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89749"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89749.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00217,"epssPercentile":0.12082,"ingestedAt":"2026-09-14T15:23:07.448Z","slug":"CVE-2026-89749","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix crash passing ERR_PTR to kthread_stop()\n\nevent_test_stuff() calls kthread_run() and unconditionally passes the\nreturned task_struct pointer to kthread_stop(). kthread_run() returns an\nerror pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for\nexample under memory pressure during the boot-time event self-test.\nkthread_stop() then dereferences the invalid pointer, crashing the kernel.\n\nCheck the result of kthread_run() before passing it to kthread_stop(). Use\nWARN_ON() so that a failure to create the self-test thread does not go\nunnoticed, matching the ring-buffer self-test fix in commit\n91542863abad (\"ring-buffer: Fix crash passing ERR_PTR to kthread_stop()\").\n\n## Affected\n\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < c1a4fb7aa290f158d50654d640292e49d9055fd1`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 42ccb215ef0a552acbbd32f81009bfe4b278ba77`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 98d06fb9865a490e12ebe32d65b9ffac6108614d`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < ceb1707aef5824cf024eb82d10787b7621e2ff35`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 12a499f741fc5be3731c8b0a0d909406575cc2eb`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < adadf4192f700bca82abfda9fa6d58c0bf37cc04`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < c40e0b4fa365969e67011529eabdfb66d1022256`\n- `Linux >= e6187007d6c365b551c69ea3df46f06fd1c8bd19 < 649bc7df3e5d7be6f7996a95084037dbf3cad1e5`\n- `Linux 2.6.31`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89749.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":203934,"id":"CVE-2026-89749","ts":1789490227922,"field":"cvss","old":null,"new":"5.5"},{"seq":203933,"id":"CVE-2026-89749","ts":1789490227922,"field":"severity","old":"none","new":"medium"},{"seq":147065,"id":"CVE-2026-89749","ts":1789270195020,"field":"cvss","old":null,"new":"4.4"},{"seq":147064,"id":"CVE-2026-89749","ts":1789270195020,"field":"severity","old":"none","new":"medium"}]}