{"id":"CVE-2026-99232","kind":"vulnerability","aliases":["CVE-2026-99232"],"related":[],"title":"Linux kernel: tracing syscall buffer copy skips user-address check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch.","summary":"The Linux kernel's syscall tracing code copied syscall buffer arguments with a routine that skips the access check that rejects non-user addresses. The fix switches to the checked copy routine so invalid addresses are rejected and recorded as faulted.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T16:17:48+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:52+00:00","updated_at":"2026-11-02T16:26:52+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T16:26:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: tracing syscall buffer copy skips user-address check","impact":"low","summary":"The Linux kernel's syscall tracing code copied syscall buffer arguments with a routine that skips the access check that rejects non-user addresses. The fix switches to the checked copy routine so invalid addresses are rejected and recorded as faulted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm affected kernel version ranges and whether perf/tracing privilege is required, using the upstream kernel commit or the NVD entry.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources describe the flaw only as a concern for machines that trust perf too much; they do not say which kernel versions are affected or what configuration exposes it. Teams running Linux servers should check their kernel version against their vendor's advisory. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000636,"input_tokens":4192,"output_tokens":433,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99232':14A,17A 'access':38B,102C 'address':10A,45B,56B,114C 'argument':31B,90C 'array':86C 'bit':136C 'buffer':5A,30B,82C,89C 'check':11A,39B,51B 'code':27B 'concern':129C 'copi':6A,28B,52B,75C,84C,87C,97C,105C 'could':125C 'cve':12A,15A 'entri':119C 'fault':62B,123C 'faultabl':80C,92C 'fix':47B 'follow':68C 'infrastructur':18B 'instead':108C 'invalid':55B 'kernel':2A,19B,23B,66C 'linux':1A,20B,22B,65C 'machin':131C 'much':138C 'non':43B,112C 'non-us':42B,111C 'ok':103C 'perf':134C 'pwrite64':95C 'record':60B,121C 'reject':41B,58B,116C 'resolv':72C 'routin':34B,53B 'secur':128C 'skip':7A,36B,101C 'switch':48B 'syscal':4A,25B,29B,81C,83C,93C 'trace':3A,26B 'tracing/syscalls':73C 'trust':133C 'use':74C,104C 'user':9A,44B,77C,85C,99C,107C,113C 'user-address':8A 'vulner':69C 'write':94C","nicknames":[],"mitigations":[],"who_affected":"The sources describe the flaw only as a concern for machines that trust perf too much; they do not say which kernel versions are affected or what configuration exposes it. Teams running Linux servers should check their kernel version against their vendor's advisory. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","kernel","linux","unknown"],"first_public_at":"2026-11-02T16:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99232","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99232","severity":null,"published_at":"2026-11-02T16:17:48+00:00","modified_at":"2026-11-02T16:17:48+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}