Live › vulnerability › CVE-2026-99237
Linux kernel tracing: update_last_data_if_empty() runs from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can free module_delta twice, and a module notifier can update it while it is being freed. Fixed upstream by commit 5a6bd62f0914; stable backports for 6.18 and 7.2 are in review.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Systems running a Linux kernel with the affected tracing code, typically servers and hosts where kernel tracing is used. The sources do not say which kernel versions are affected or whether an unprivileged user can reach the path. unknown
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux-kernel | linux | kernels containing commit 32dc0042528d and not 5a6bd62f0914; exact versions unknown | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tracing: Hold trace_types_lock when resetting last boot data from readers
update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.
Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.
This page as .md · .json · in your agent: get_signal("CVE-2026-99237")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.