Live › vulnerability › CVE-2026-99238
Linux kernel trace_module_record() walks the list of trace instances from the module notifier without holding trace_types_lock. A concurrent rmdir of an instance can free it, so a module load or unload can use freed memory. The upstream fix adds the missing lock. It is queued in the tracing tree and has no confirmed release version yet. NVD scores it 7.8 with a local, low-privilege vector.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
The flaw is in the kernel's persistent tracing instances, which are created and removed through the tracefs interface. The sources do not say which kernel versions are affected or whether systems that never create tracing instances are exposed, so the affected range is unknown. Systems that run standard kernels with tracing instances in use are the ones to look at first.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux-kernel | linux | kernels containing commit 5f3719f697c3 and not the fix; exact version range unknown | – |
uname -r and compare against your distribution's advisory for CVE-2026-99238; no fixed version is published upstream yet.ls /sys/kernel/tracing/instances (the race needs an instance being removed with rmdir while a module loads or unloads).tracing: Hold trace_types_lock when updating modules in persistent instances is queued in the tracing for-next tree (Cc stable)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tracing: Hold trace_types_lock when updating modules in persistent instances
trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array.
This page as .md · .json · in your agent: get_signal("CVE-2026-99238")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.