{"id":"CVE-2026-99219","kind":"vulnerability","aliases":["CVE-2026-99219"],"related":[],"title":"Linux kernel: ftrace uninitialized variable crashes reading available_filter_functions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name.","summary":"In the Linux kernel's ftrace tracing code, a module name variable is left uninitialized when a symbol lookup fails during module load or unload. Reading the available_filter_functions file in that window can dereference the garbage value and cause a general protection fault.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftrace","linux-kernel","runtime"],"not_affected_if":["no-ftrace-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:27:02+00:00","updated_at":"2026-11-02T16:27:02+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-02T16:27:02Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: ftrace uninitialized variable crashes reading available_filter_functions","impact":"low","summary":"In the Linux kernel's ftrace tracing code, a module name variable is left uninitialized when a symbol lookup fails during module load or unload. Reading the available_filter_functions file in that window can dereference the garbage value and cause a general protection fault.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ftrace"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel crash via general protection fault, denial of service","analyst_note":"Confirm affected kernel version ranges and the fixed commit from the kernel.org or NVD entry.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-ftrace-access"],"who_is_affected":"Systems running a Linux kernel with ftrace available, where a user or process reads available_filter_functions while kernel modules are being loaded or unloaded. The sources do not state affected kernel version ranges. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000656,"input_tokens":4344,"output_tokens":444,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':136C,141C,145C,149C,153C,158C '-2026':12A,15A '-99219':13A,16A '0010':134C 'avail':8A,49B,166C 'call':138C 'caus':62B 'check':122C 'code':29B 'crash':6A 'cve':11A,14A 'derefer':57B 'dereferenc':125C 'fail':41B,103C,182C 'fault':66B,132C 'file':52B 'filter':9A,50B,167C 'follow':72C 'ftrace':3A,17B,27B,77C 'function':10A,51B,168C 'garbag':59B,116C 'general':64B,130C 'hold':114C 'initi':78C,177C 'iter':157C 'kallsym':93C 'kernel':2A,20B,25B,70C 'leav':87C 'left':35B 'like':104C 'linux':1A,19B,24B,69C 'linux-kernel':18B 'load':44B,110C,174C 'lookup':40B,94C,102C,183C 'modnam':79C,88C,113C,121C 'modul':31B,43B,107C,171C,186C 'name':32B,187C 'offset':81C,90C 'oop':129C 'pass':118C 'print':83C,85C,147C 'printf':128C,144C 'protect':65B,131C 'read':7A,47B,156C,165C 'rec':84C,86C,148C 'resolv':76C 'rip':133C 'runtim':21B 'seq':127C,143C,155C 'set':96C 'show':152C 'skip':184C 'string':135C 'success':99C 'symbol':39B 'trace':28B,139C 'trigger':163C 'uniniti':4A,36B,91C 'unload':46B,112C,176C 'valu':60B,117C 'variabl':5A,33B,179C 'vsnprintf':140C 'vulner':73C 'window':55B 'x119/0x480':159C 'x1f5/0x650':142C 'x48/0xe0':137C 'x4c/0x440':154C 'x6c/0xc0':150C 'x8e/0xb0':146C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with ftrace available, where a user or process reads available_filter_functions while kernel modules are being loaded or unloaded. The sources do not state affected kernel version ranges. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ftrace","linuxkernel","runtime","unknown"],"first_public_at":"2026-11-02T16:17:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99219","severity":null,"published_at":"2026-11-02T16:17:45+00:00","modified_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}