Description
In the Linux kernel, the following vulnerability has been resolved:

perf/ftrace: Fix WARNING in __unregister_ftrace_function

perf_ftrace_function_unregister() unconditionally calls
unregister_ftrace_function() without checking whether the ftrace_ops
was ever successfully registered. This triggers a WARN_ON in
__unregister_ftrace_function() when the ops doesn't have
FTRACE_OPS_FL_ENABLED set.

This can happen during perf_event_alloc() error cleanup when
perf_trace_destroy() is called via __free_event() on an event whose
ftrace_ops registration failed or was already torn down by
perf_try_init_event()'s err_destroy path.

The call path is:
perf_event_alloc() error cleanup
-> __free_event()
-> event->destroy() [tp_perf_event_destroy]
-> perf_trace_destroy()
-> perf_trace_event_close()
-> TRACE_REG_PERF_CLOSE
-> perf_ftrace_function_unregister()
-> unregister_ftrace_function()
-> __unregister_ftrace_function()
-> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))

Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to
unregister. If the ops is not enabled, just free the filter and
return success.
Published: 2026-09-24
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel warning / potential instability
Action: Patch
AI Analysis

Impact

In the Linux kernel, the code that unregisters a ftrace function can trigger a WARN_ON if the ftrace_ops was never enabled or has already been torn down. This warning is produced during perf_event allocation error cleanup when the ftrace_ops registration failed, leading the kernel to log a warning. The vulnerability is a logic flaw that causes unexpected warning logs during normal error handling and does not explicitly result in a crash or denial of service. The flaw manifests when perf_event_alloc() encounters an error and its cleanup path walks through perf_trace_event_close() and ultimately __unregister_ftrace_function().

Affected Systems

The issue exists in all Linux kernel releases before the fix was committed to the repository. Any vendor that ships a kernel based on those releases inherits the flaw. No specific version list is provided, so the vulnerability applies broadly to unpatched kernels.

Risk and Exploitability

The CVE is not listed in the KEV catalog and its EPSS score is unavailable. Exploitation would require triggering a perf_event allocation error, which typically requires privileged or kernel-level access. The resulting WARN_ON may surface only in kernel logs and does not provide a clear path to code execution or a service denial. Consequently the overall risk is moderate, higher for privileged users on unpatched systems.

Generated by OpenCVE AI on September 25, 2026 at 04:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel update that contains the patch for the ftrace warning issue.
  • Reboot the system after updating to ensure cached ftrace state is cleared.
  • Monitor kernel logs for the string "perf/ftrace: WARN" to verify the patch is active and to detect any residual warning conditions.

Generated by OpenCVE AI on September 25, 2026 at 04:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-398

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in __unregister_ftrace_function perf_ftrace_function_unregister() unconditionally calls unregister_ftrace_function() without checking whether the ftrace_ops was ever successfully registered. This triggers a WARN_ON in __unregister_ftrace_function() when the ops doesn't have FTRACE_OPS_FL_ENABLED set. This can happen during perf_event_alloc() error cleanup when perf_trace_destroy() is called via __free_event() on an event whose ftrace_ops registration failed or was already torn down by perf_try_init_event()'s err_destroy path. The call path is: perf_event_alloc() error cleanup -> __free_event() -> event->destroy() [tp_perf_event_destroy] -> perf_trace_destroy() -> perf_trace_event_close() -> TRACE_REG_PERF_CLOSE -> perf_ftrace_function_unregister() -> unregister_ftrace_function() -> __unregister_ftrace_function() -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED)) Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to unregister. If the ops is not enabled, just free the filter and return success.
Title perf/ftrace: Fix WARNING in __unregister_ftrace_function
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-24T16:03:57.790Z

Reserved: 2026-09-24T14:53:16.870Z

Link: CVE-2026-97443

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T17:17:22.550

Modified: 2026-09-24T17:17:22.550

Link: CVE-2026-97443

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T04:15:13Z

Weaknesses