GHSA-C83F-FGH5-9532
Vulnerability from github – Published: 2026-09-24 18:31 – Updated: 2026-09-24 18:31In the Linux kernel, the following vulnerability has been resolved:
perf/ftrace: Fix WARNING in __unregister_ftrace_function
perf_ftrace_function_unregister() unconditionally calls unregister_ftrace_function() without checking whether the ftrace_ops was ever successfully registered. This triggers a WARN_ON in __unregister_ftrace_function() when the ops doesn't have FTRACE_OPS_FL_ENABLED set.
This can happen during perf_event_alloc() error cleanup when perf_trace_destroy() is called via __free_event() on an event whose ftrace_ops registration failed or was already torn down by perf_try_init_event()'s err_destroy path.
The call path is: perf_event_alloc() error cleanup -> __free_event() -> event->destroy() [tp_perf_event_destroy] -> perf_trace_destroy() -> perf_trace_event_close() -> TRACE_REG_PERF_CLOSE -> perf_ftrace_function_unregister() -> unregister_ftrace_function() -> __unregister_ftrace_function() -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))
Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to unregister. If the ops is not enabled, just free the filter and return success.
{
"affected": [],
"aliases": [
"CVE-2026-97443"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-24T17:17:22Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/ftrace: Fix WARNING in __unregister_ftrace_function\n\nperf_ftrace_function_unregister() unconditionally calls\nunregister_ftrace_function() without checking whether the ftrace_ops\nwas ever successfully registered. This triggers a WARN_ON in\n__unregister_ftrace_function() when the ops doesn\u0027t have\nFTRACE_OPS_FL_ENABLED set.\n\nThis can happen during perf_event_alloc() error cleanup when\nperf_trace_destroy() is called via __free_event() on an event whose\nftrace_ops registration failed or was already torn down by\nperf_try_init_event()\u0027s err_destroy path.\n\nThe call path is:\n perf_event_alloc() error cleanup\n -\u003e __free_event()\n -\u003e event-\u003edestroy() [tp_perf_event_destroy]\n -\u003e perf_trace_destroy()\n -\u003e perf_trace_event_close()\n -\u003e TRACE_REG_PERF_CLOSE\n -\u003e perf_ftrace_function_unregister()\n -\u003e unregister_ftrace_function()\n -\u003e __unregister_ftrace_function()\n -\u003e WARN_ON(!(ops-\u003eflags \u0026 FTRACE_OPS_FL_ENABLED))\n\nFix this by checking FTRACE_OPS_FL_ENABLED before attempting to\nunregister. If the ops is not enabled, just free the filter and\nreturn success.",
"id": "GHSA-c83f-fgh5-9532",
"modified": "2026-09-24T18:31:33Z",
"published": "2026-09-24T18:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97443"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f845820afaad339341c2ae42bc7fdec175df9ea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9581123304b23049437324038698af9fb56ee663"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/df097713b56ffac5eed32a9be2e7d27ac48d9087"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.