{"id":"CVE-2026-99237","kind":"vulnerability","aliases":["CVE-2026-99237"],"related":[],"title":"Linux kernel: tracing readers can free boot data twice, causing memory corruption","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when resetting last boot data from readers\n\nupdate_last_data_if_empty() is called from tracing_open() with O_TRUNC,\ntracing_read_pipe() and tracing_buffers_read() without trace_types_lock.\nTwo readers can both pass the LAST_BOOT test and free module_delta\ntwice, and a module notifier can update module_delta while it is being\nfreed.\n\nTake trace_types_lock in those paths and keep the callers that already\nhold it on an unlocked variant.","summary":"Linux kernel tracing: update_last_data_if_empty() runs from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can free module_delta twice, and a module notifier can update it while it is being freed. Fixed upstream by commit 5a6bd62f0914; stable backports for 6.18 and 7.2 are in review.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"linux-kernel","fixed":[],"affected":"kernels containing commit 32dc0042528d and not 5a6bd62f0914; exact versions unknown","ecosystem":"linux"}],"ecosystems":[],"tags":["infrastructure","kernel","linux","local","self-hosted","tracing"],"not_affected_if":["tracefs-restricted"],"how_to_check":"- Run uname -r, then check your distribution's kernel changelog or security tracker for CVE-2026-99237 or upstream commit 5a6bd62f0914.\n- The bug is in code added by commit 32dc0042528d (last-boot trace buffer reset), so a kernel without that commit is not affected. The affected version range is unknown from the sources read.\n- Check who can open tracefs: ls -ld /sys/kernel/tracing. The sources do not say whether unprivileged users can reach the paths; the CVSS vector is local, low privileges.","fix":"Mainline commit 5a6bd62f09147b49b31fd19d4eba122cb5f941a1 takes trace_types_lock in the reader paths. It is queued as a stable review patch for 6.18 and 7.2. A released fixed version is not yet confirmed: install your distribution's kernel update that lists CVE-2026-99237.","status":"open","published_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:31+00:00","updated_at":"2026-11-02T16:27:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T16:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: tracing readers can free boot data twice, causing memory corruption","impact":"medium","summary":"In the Linux kernel tracing code, several reader paths reset last-boot trace data without holding the trace types lock, so two readers can free the same memory twice and a module notifier can race with the free. The sources do not state what an attacker can gain beyond a memory corruption fault.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","tracing","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Kernel memory corruption from a double free; code execution not stated","analyst_note":"Find the affected and fixed kernel version ranges and whether a local unprivileged user can trigger the tracing readers, from the NVD entry or the kernel stable commit.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed release in the kernel stable series, if the sources name one.\n- Confirm whether tracing is in use with `ls /sys/kernel/tracing` or `ls /sys/kernel/debug/tracing` (unknown whether this is an exposure check).","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the affected tracing code, typically servers and hosts where kernel tracing is used. The sources do not say which kernel versions are affected or whether an unprivileged user can reach the path. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4221,"output_tokens":576,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed kernel version ranges and whether a local unprivileged user can trigger the tracing readers, from the NVD entry or the kernel stable commit.","search":"'-2026':14A,17A '-99237':15A,18A '5a6bd62f0914':79B '6.18':83B '7.2':85B 'alreadi':174C 'backport':81B 'boot':7A,107C,142C 'buffer':50B,129C 'call':117C 'caller':172C 'caus':10A 'commit':78B 'corrupt':12A 'cve':13A,16A 'data':8A,35B,108C,113C 'delta':61B,147C,156C 'empti':37B,115C 'fix':75B 'follow':94C 'free':6A,59B,145C 'freed':74B,161C 'hold':100C,175C 'host':28B 'infrastructur':22B 'keep':170C 'kernel':2A,21A,23B,31B,92C 'last':34B,106C,112C,141C 'linux':1A,20A,24B,30B,91C 'linux-kernel':19A 'local':25B 'lock':55B,103C,134C,165C 'memori':11A 'modul':60B,65B,146C,151C,155C 'notifi':66B,152C 'o':43B,122C 'open':41B,120C 'pass':139C 'path':168C 'pipe':47B,126C 'read':46B,51B,125C,130C 'reader':4A,57B,110C,136C 'reset':105C 'resolv':98C 'review':88B 'run':38B 'self':27B 'self-host':26B 'stabl':80B 'take':162C 'test':143C 'trace':3A,29B,32B,40B,45B,49B,53B,99C,101C,119C,124C,128C,132C,163C 'trunc':44B,123C 'twice':9A,62B,148C 'two':56B,135C 'type':54B,102C,133C,164C 'unlock':179C 'updat':33B,68B,111C,154C 'upstream':76B 'variant':180C 'vulner':95C 'without':52B,131C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the affected tracing code, typically servers and hosts where kernel tracing is used. The sources do not say which kernel versions are affected or whether an unprivileged user can reach the path. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["linuxkernel"],"ptokens":["kernel","linux"],"labels":["high","infrastructure","kernel","linux","local","selfhosted","tracing"],"first_public_at":"2026-11-02T16:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99237","severity":null,"published_at":"2026-11-02T16:17:49+00:00","modified_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99237:1389","url":null,"severity":null,"published_at":"2026-11-02T16:27:35+00:00","modified_at":"2026-11-02T16:27:35+00:00","first_seen_at":"2026-11-02T16:27:35+00:00","fetched_at":"2026-11-02T16:27:35+00:00","note":"Read the maintainer patch (Rostedt for-next, 2026-10-20) and the 6.18/7.2 stable review patches. Mainline fix is commit 5a6bd62f0914 (David Carlier), Fixes: 32dc0042528d. No released fixed version or affected range was stated in sources read; NVD page was empty. Not stated whether tracefs is reachable by unprivileged users. Nothing verified."}],"documents":[{"id":52849,"url":"https://lore.landau.one/lkml/20261020122011.033386537@kernel.org/","title":"tracing: Hold trace_types_lock when resetting last boot data from readers (Rostedt for-next, 2026-10-20)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":52850,"url":"https://ci.syzbot.org/patches/9325c52c-52fe-4ad0-b461-f0734828d66a","title":"7.2-stable review patch: upstream commit 5a6bd62f0914","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52851,"url":"https://ci.syzbot.org/patches/dbb9227c-7224-441f-877e-68d09c46c916","title":"6.18-stable review patch: upstream commit 5a6bd62f0914","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}