Description
In the Linux kernel, the following vulnerability has been resolved:

tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg

Sashiko found that user can cause this WARN_ON_ONCE() easily
with adding a kprobe event based on a raw address with BTF
parameter.

Since this is not an unexpected condition, remove the
WARN_ON_ONCE().
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel change removes a WARN_ON_ONCE macro call from the parse_btf_arg routine. The removed check was not considered an unexpected condition, and its removal means that a user with privileged access can trigger the warning by adding a kprobe event that uses a raw address with a BTF parameter. The security impact of triggering a kernel warning is limited to potential log noise and minor performance overhead; there is no direct disclosure, privilege escalation, or denial‑of‑service mechanism identified in the provided description.

Affected Systems

All Linux kernel versions that contain the original WARN_ON_ONCE call in parse_btf_arg are affected. No specific kernel releases are listed, so any kernel build containing the message is potentially subject to the behavior described. The vendor information indicates a general Linux kernel impact rather than a vendor‑specific product.

Risk and Exploitability

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, implying that there is currently no evidence of active exploitation. The attack vector would require elevated privileges to register a custom kprobe event, so the practical risk is low. The removal of the warning does not change the kernel’s security boundaries, only the frequency of warning messages in the log.

Generated by OpenCVE AI on August 28, 2026 at 09:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest Linux kernel release that includes the patch removing WARN_ON_ONCE.
  • If you need to create kprobe events that rely on BTF parameters, validate the target addresses before registering the probes to avoid unnecessary warning triggers.
  • Monitor kernel logs for abnormal warning frequencies and disable or remove kprobe instrumentation that is no longer required.

Generated by OpenCVE AI on August 28, 2026 at 09:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-710

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg Sashiko found that user can cause this WARN_ON_ONCE() easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove the WARN_ON_ONCE().
Title tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:48:31.556Z

Reserved: 2026-08-26T14:34:25.772Z

Link: CVE-2026-80607

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:44.677

Modified: 2026-08-28T08:16:44.677

Link: CVE-2026-80607

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T10:45:04Z

Weaknesses
  • CWE-710

    Improper Adherence to Coding Standards