{"id":"CVE-2026-99141","kind":"vulnerability","aliases":["CVE-2026-99141"],"related":[],"title":"Linux kernel: tracing switch can crash the kernel via NULL pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix crash in print_graph_function_event()\n\ntracing_set_tracer() assigns the flags of the newly selected tracer\nwith:\n\n\ttr->current_trace_flags = t->flags ? : t->tracer->flags;\n\nIf the new tracer defines neither static flags nor default flags, like\nhwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy\nfor it, and both operands are NULL, so tr->current_trace_flags ends up\nbeing NULL as well.\n\nThe ring buffer is not cleared when switching tracers: it is reset\ninside tracer_init(), after current_trace_flags was already assigned.\nIf the buffer still holds function_graph entries of the previous\ntracer, printing one of them dereferences the NULL pointer. This was\nhit by cat trace during an ftrace stress test:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  #PF: supervisor read access in kernel mode\n  RIP: 0010:print_graph_function_event+0xe/0x20\n  Call Trace:\n   s_show+0x4d/0x110\n   seq_read_iter+0x2d4/0x490\n   seq_read+0x130/0x170\n   vfs_read+0xb5/0x370\n   ksys_read+0x6d/0xe0\n   do_syscall_64+0xbc/0x450\n\nThe snapshot buffer is not reset at all, so this can be reproduced\nwithout a race:\n\n  echo function_graph > /sys/kernel/tracing/current_tracer\n  echo 1 > /sys/kernel/tracing/snapshot\n  echo hwlat > /sys/kernel/tracing/current_tracer\n  cat /sys/kernel/tracing/snapshot\n\nRather than teaching every user of tr->current_trace_flags about this\ncorner case, make sure it is never NULL: when the newly selected\ntracer has no flags at all, tracing_set_tracer() falls back to a\nstatic empty no_tracer_flags. run_tracer_selftest() can hit the same\ncase, so the same fallback is added there too. The existing users\nalready handle opts == NULL, so these tracers keep behaving as before.","summary":"When switching ftrace tracers, a leftover function_graph trace buffer can be printed with a NULL flags pointer, causing a kernel NULL pointer dereference. The sources describe a crash (denial of service) from reading the trace file, not code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftrace","linux-kernel","runtime","self-hosted"],"not_affected_if":["no-ftrace-use","tracefs-not-exposed"],"how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name\n- `cat /sys/kernel/tracing/current_tracer` to see whether ftrace is in use at all\n- unknown whether the sources list affected version ranges","fix":"- Update to a Linux kernel build that includes the upstream commit titled 'tracing: Fix crash in print_graph_function_event()'; the fixed version number is unknown from the sources\n- unknown whether distributions have shipped the backport","status":"open","published_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:06+00:00","updated_at":"2026-10-28T11:36:06+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:36:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream commit titled 'tracing: Fix crash in print_graph_function_event()'; the fixed version number is unknown from the sources\n- unknown whether distributions have shipped the backport","reach":"local","title":"Linux kernel: tracing switch can crash the kernel via NULL pointer","impact":"low","summary":"When switching ftrace tracers, a leftover function_graph trace buffer can be printed with a NULL flags pointer, causing a kernel NULL pointer dereference. The sources describe a crash (denial of service) from reading the trace file, not code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","ftrace"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel crash from reading trace file (denial of service)","analyst_note":"Check the upstream kernel commit and stable backports for the fixed version ranges and distribution advisories; the sources give no versions.","how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name\n- `cat /sys/kernel/tracing/current_tracer` to see whether ftrace is in use at all\n- unknown whether the sources list affected version ranges","needs_analyst":true,"not_affected_if":["no-ftrace-use","tracefs-not-exposed"],"who_is_affected":"Systems running a Linux kernel with ftrace tracing enabled and tracefs mounted, where a user or tool can change tracers and read the trace file. The sources describe a reproduction via the tracing sysfs files, which normally requires root. Machines that do not use ftrace are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":3944,"output_tokens":625,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':220C,226C,231C,235C,239C,243C,248C '-2026':13A,16A '-99141':14A,17A '/sys/kernel/tracing/current_tracer':269C,275C '/sys/kernel/tracing/snapshot':272C,277C '0000000000000000':206C '0010':215C '1':271C '64':247C 'access':210C 'add':121C,333C 'address':205C 'alreadi':167C,339C 'assign':87C,168C 'back':312C 'behav':347C 'buffer':35B,149C,171C,252C 'bug':200C 'call':222C 'case':291C,327C 'cat':193C,276C 'caus':44B 'clear':152C 'code':64B 'copi':128C 'corner':290C 'crash':6A,54B,78C 'current':97C,138C,163C,285C 'cve':12A,15A 'default':114C 'defin':109C 'denial':55B 'derefer':49B,185C,204C 'describ':52B 'echo':266C,270C,273C 'empti':316C 'end':141C 'entri':176C 'event':83C,219C 'everi':281C 'execut':65B 'exist':337C 'fall':311C 'fallback':331C 'file':62B 'fix':77C 'flag':42B,89C,99C,101C,104C,112C,115C,127C,140C,165C,287C,305C,319C 'follow':71C 'ftrace':18B,28B,197C 'function':32B,82C,174C,218C,267C 'graph':33B,81C,175C,217C,268C 'handl':340C 'hit':191C,324C 'hold':173C 'host':25B 'hwlat':117C,274C 'init':161C 'insid':159C 'instanc':126C 'irqsoff':118C 'iter':230C 'keep':346C 'kernel':2A,8A,21B,46B,69C,201C,212C 'ksys':241C 'leftov':31B 'like':116C 'linux':1A,20B,68C 'linux-kernel':19B 'make':292C 'mode':213C 'neither':110C 'never':296C 'new':107C 'newli':92C,300C 'null':10A,41B,47B,135C,144C,187C,202C,297C,342C 'one':182C 'operand':133C 'opt':341C 'per':125C 'pf':207C 'pointer':11A,43B,48B,188C,203C 'previous':179C 'print':38B,80C,181C,216C 'race':265C 'rather':278C 'read':59B,209C,229C,234C,238C,242C 'reproduc':262C 'reset':158C,255C 'resolv':75C 'ring':148C 'rip':214C 'run':320C 'runtim':22B 'select':93C,301C 'self':24B 'self-host':23B 'selftest':322C 'seq':228C,233C 'servic':57B 'set':85C,309C 'show':225C 'snapshot':251C 'sourc':51B 'static':111C,315C 'still':172C 'stress':198C 'supervisor':208C 'sure':293C 'switch':4A,27B,154C 'syscal':246C 'teach':280C 'test':199C 'tr':96C,137C,284C 'trace':3A,34B,61B,76C,84C,98C,139C,164C,194C,223C,286C,308C 'tracer':29B,86C,94C,103C,108C,122C,155C,160C,180C,302C,310C,318C,321C,345C 'user':282C,338C 'vfs':237C 'via':9A 'vulner':72C 'wakeup':120C 'well':146C 'without':263C 'x130/0x170':236C 'x2d4/0x490':232C 'x4d/0x110':227C 'x6d/0xe0':244C 'xb5/0x370':240C 'xbc/0x450':249C 'xe/0x20':221C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with ftrace tracing enabled and tracefs mounted, where a user or tool can change tracers and read the trace file. The sources describe a reproduction via the tracing sysfs files, which normally requires root. Machines that do not use ftrace are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99141","severity":null,"published_at":"2026-10-28T11:17:34+00:00","modified_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}