CVE-2026-43409 (GCVE-0-2026-43409)
Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-05-08 14:21
VLAI?
Title
kprobes: avoid crash when rmmod/insmod after ftrace killed
Summary
In the Linux kernel, the following vulnerability has been resolved:
kprobes: avoid crash when rmmod/insmod after ftrace killed
After we hit ftrace is killed by some errors, the kernel crash if
we remove modules in which kprobe probes.
BUG: unable to handle page fault for address: fffffbfff805000d
PGD 817fcc067 P4D 817fcc067 PUD 817fc8067 PMD 101555067 PTE 0
Oops: Oops: 0000 [#1] SMP KASAN PTI
CPU: 4 UID: 0 PID: 2012 Comm: rmmod Tainted: G W OE
Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
RIP: 0010:kprobes_module_callback+0x89/0x790
RSP: 0018:ffff88812e157d30 EFLAGS: 00010a02
RAX: 1ffffffff805000d RBX: dffffc0000000000 RCX: ffffffff86a8de90
RDX: ffffed1025c2af9b RSI: 0000000000000008 RDI: ffffffffc0280068
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1025c2af9a
R10: ffff88812e157cd7 R11: 205d323130325420 R12: 0000000000000002
R13: ffffffffc0290488 R14: 0000000000000002 R15: ffffffffc0280040
FS: 00007fbc450dd740(0000) GS:ffff888420331000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff805000d CR3: 000000010f624000 CR4: 00000000000006f0
Call Trace:
<TASK>
notifier_call_chain+0xc6/0x280
blocking_notifier_call_chain+0x60/0x90
__do_sys_delete_module.constprop.0+0x32a/0x4e0
do_syscall_64+0x5d/0xfa0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
This is because the kprobe on ftrace does not correctly handles
the kprobe_ftrace_disabled flag set by ftrace_kill().
To prevent this error, check kprobe_ftrace_disabled in
__disarm_kprobe_ftrace() and skip all ftrace related operations.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 8b6767e4141b2a42745b544d4555cf1614ba1a2d
(git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < b0ca81616a010807e91fc31db9be242b96326adc (git) Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < cae928e3178c75602c21d67e21255d73e7e9ed4f (git) Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 9edc79d664832a842012ad105b1521c1a3c35ab3 (git) Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < e113f0b46d19626ec15388bcb91432c9a4fd6261 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/kprobes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8b6767e4141b2a42745b544d4555cf1614ba1a2d",
"status": "affected",
"version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
"versionType": "git"
},
{
"lessThan": "b0ca81616a010807e91fc31db9be242b96326adc",
"status": "affected",
"version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
"versionType": "git"
},
{
"lessThan": "cae928e3178c75602c21d67e21255d73e7e9ed4f",
"status": "affected",
"version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
"versionType": "git"
},
{
"lessThan": "9edc79d664832a842012ad105b1521c1a3c35ab3",
"status": "affected",
"version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
"versionType": "git"
},
{
"lessThan": "e113f0b46d19626ec15388bcb91432c9a4fd6261",
"status": "affected",
"version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/kprobes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: avoid crash when rmmod/insmod after ftrace killed\n\nAfter we hit ftrace is killed by some errors, the kernel crash if\nwe remove modules in which kprobe probes.\n\nBUG: unable to handle page fault for address: fffffbfff805000d\nPGD 817fcc067 P4D 817fcc067 PUD 817fc8067 PMD 101555067 PTE 0\nOops: Oops: 0000 [#1] SMP KASAN PTI\nCPU: 4 UID: 0 PID: 2012 Comm: rmmod Tainted: G W OE\nTainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nRIP: 0010:kprobes_module_callback+0x89/0x790\nRSP: 0018:ffff88812e157d30 EFLAGS: 00010a02\nRAX: 1ffffffff805000d RBX: dffffc0000000000 RCX: ffffffff86a8de90\nRDX: ffffed1025c2af9b RSI: 0000000000000008 RDI: ffffffffc0280068\nRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1025c2af9a\nR10: ffff88812e157cd7 R11: 205d323130325420 R12: 0000000000000002\nR13: ffffffffc0290488 R14: 0000000000000002 R15: ffffffffc0280040\nFS: 00007fbc450dd740(0000) GS:ffff888420331000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: fffffbfff805000d CR3: 000000010f624000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n notifier_call_chain+0xc6/0x280\n blocking_notifier_call_chain+0x60/0x90\n __do_sys_delete_module.constprop.0+0x32a/0x4e0\n do_syscall_64+0x5d/0xfa0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is because the kprobe on ftrace does not correctly handles\nthe kprobe_ftrace_disabled flag set by ftrace_kill().\n\nTo prevent this error, check kprobe_ftrace_disabled in\n__disarm_kprobe_ftrace() and skip all ftrace related operations."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T14:21:48.239Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b6767e4141b2a42745b544d4555cf1614ba1a2d"
},
{
"url": "https://git.kernel.org/stable/c/b0ca81616a010807e91fc31db9be242b96326adc"
},
{
"url": "https://git.kernel.org/stable/c/cae928e3178c75602c21d67e21255d73e7e9ed4f"
},
{
"url": "https://git.kernel.org/stable/c/9edc79d664832a842012ad105b1521c1a3c35ab3"
},
{
"url": "https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261"
}
],
"title": "kprobes: avoid crash when rmmod/insmod after ftrace killed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43409",
"datePublished": "2026-05-08T14:21:48.239Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-05-08T14:21:48.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-43409\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:52.513\",\"lastModified\":\"2026-05-08T15:16:52.513\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkprobes: avoid crash when rmmod/insmod after ftrace killed\\n\\nAfter we hit ftrace is killed by some errors, the kernel crash if\\nwe remove modules in which kprobe probes.\\n\\nBUG: unable to handle page fault for address: fffffbfff805000d\\nPGD 817fcc067 P4D 817fcc067 PUD 817fc8067 PMD 101555067 PTE 0\\nOops: Oops: 0000 [#1] SMP KASAN PTI\\nCPU: 4 UID: 0 PID: 2012 Comm: rmmod Tainted: G W OE\\nTainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\\nRIP: 0010:kprobes_module_callback+0x89/0x790\\nRSP: 0018:ffff88812e157d30 EFLAGS: 00010a02\\nRAX: 1ffffffff805000d RBX: dffffc0000000000 RCX: ffffffff86a8de90\\nRDX: ffffed1025c2af9b RSI: 0000000000000008 RDI: ffffffffc0280068\\nRBP: 0000000000000000 R08: 0000000000000001 R09: ffffed1025c2af9a\\nR10: ffff88812e157cd7 R11: 205d323130325420 R12: 0000000000000002\\nR13: ffffffffc0290488 R14: 0000000000000002 R15: ffffffffc0280040\\nFS: 00007fbc450dd740(0000) GS:ffff888420331000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: fffffbfff805000d CR3: 000000010f624000 CR4: 00000000000006f0\\nCall Trace:\\n \u003cTASK\u003e\\n notifier_call_chain+0xc6/0x280\\n blocking_notifier_call_chain+0x60/0x90\\n __do_sys_delete_module.constprop.0+0x32a/0x4e0\\n do_syscall_64+0x5d/0xfa0\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\nThis is because the kprobe on ftrace does not correctly handles\\nthe kprobe_ftrace_disabled flag set by ftrace_kill().\\n\\nTo prevent this error, check kprobe_ftrace_disabled in\\n__disarm_kprobe_ftrace() and skip all ftrace related operations.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8b6767e4141b2a42745b544d4555cf1614ba1a2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9edc79d664832a842012ad105b1521c1a3c35ab3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0ca81616a010807e91fc31db9be242b96326adc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cae928e3178c75602c21d67e21255d73e7e9ed4f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e113f0b46d19626ec15388bcb91432c9a4fd6261\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…