{"id":"CVE-2026-99238","kind":"vulnerability","aliases":["CVE-2026-99238"],"related":[],"title":"Linux kernel: tracing instance removal can race module loads, freeing memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array.","summary":"Linux kernel trace_module_record() walks the list of trace instances from the module notifier without holding trace_types_lock. A concurrent rmdir of an instance can free it, so a module load or unload can use freed memory. The upstream fix adds the missing lock. It is queued in the tracing tree and has no confirmed release version yet. NVD scores it 7.8 with a local, low-privilege vector.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"linux-kernel","fixed":[],"affected":"kernels containing commit 5f3719f697c3 and not the fix; exact version range unknown","ecosystem":"linux"}],"ecosystems":[],"tags":["ftrace","infrastructure","linux-kernel","servers","tracing"],"not_affected_if":["unknown"],"how_to_check":"- Run `uname -r` and compare against your distribution's advisory for CVE-2026-99238; no fixed version is published upstream yet.\n- Only kernels containing commit 5f3719f697c3 ('tracing: Update modules to persistent instances when loaded') have the bug. Check whether your kernel source or changelog has it, and whether kernel/trace/trace.c trace_module_record() takes trace_types_lock.\n- Also check whether tracefs instances are used: `ls /sys/kernel/tracing/instances` (the race needs an instance being removed with rmdir while a module loads or unloads).","fix":"Upstream patch 'tracing: Hold trace_types_lock when updating modules in persistent instances' is queued in the tracing for-next tree (Cc stable). No released kernel version is confirmed yet; install your distribution's kernel update once it lists CVE-2026-99238.","status":"open","published_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:31+00:00","updated_at":"2026-11-02T16:27:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-02T16:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: tracing instance removal can race module loads, freeing memory","impact":"high","summary":"A race in the Linux kernel tracing code lets a module load or unload walk into a trace instance that a concurrent rmdir has already freed. The sources do not state what an attacker gets beyond the memory corruption this implies, and the NVD score is 7.8 (high).","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","tracing","ftrace","servers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; a freed kernel memory access could crash or be escalated","analyst_note":"Find the affected and fixed kernel version ranges and whether an unprivileged local user can trigger the race, using the NVD entry and the upstream kernel commit.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions from your distribution's advisory (unknown in the sources).\n- Check whether tracing instances are in use: `ls /sys/kernel/tracing/instances` (unknown in the sources whether this is the exact path to test).","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The flaw is in the kernel's persistent tracing instances, which are created and removed through the tracefs interface. The sources do not say which kernel versions are affected or whether systems that never create tracing instances are exposed, so the affected range is unknown. Systems that run standard kernels with tracing instances in use are the ones to look at first.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4161,"output_tokens":596,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed kernel version ranges and whether an unprivileged local user can trigger the race, using the NVD entry and the upstream kernel commit.","search":"'-2026':13A,16A '-99238':14A,17A '7.8':91B 'add':70B 'array':126C,164C 'concurr':49B,136C 'confirm':84B 'cve':12A,15A 'fix':69B 'follow':104C 'free':10A,55B,147C 'freed':65B,162C 'ftrace':21B,124C 'hold':44B,110C 'infrastructur':22B 'instanc':4A,38B,53B,119C,140C 'kernel':2A,20A,25B,29B,102C 'linux':1A,19A,24B,28B,101C 'linux-kernel':18A,23B 'list':35B,145C 'load':9A,60B,155C 'local':94B 'lock':47B,73B,113C,134C,151C 'low':96B 'low-privileg':95B 'memori':11A,66B 'miss':72B 'modul':8A,31B,41B,59B,116C,121C,129C,154C 'notifi':42B,130C 'nvd':88B 'persist':118C 'privileg':97B 'queu':76B 'race':7A 'record':32B,122C 'releas':85B 'remov':5A,141C 'resolv':108C 'rmdir':50B,137C 'score':89B 'server':26B 'trace':3A,27B,30B,37B,45B,79B,109C,111C,120C,125C,132C,163C 'tree':80B 'type':46B,112C,133C 'unload':62B,157C 'updat':115C 'upstream':68B 'use':64B 'vector':98B 'version':86B 'vulner':105C 'walk':33B,123C,159C 'without':43B,131C 'yet':87B","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the kernel's persistent tracing instances, which are created and removed through the tracefs interface. The sources do not say which kernel versions are affected or whether systems that never create tracing instances are exposed, so the affected range is unknown. Systems that run standard kernels with tracing instances in use are the ones to look at first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["linuxkernel"],"ptokens":["kernel","linux"],"labels":["ftrace","high","infrastructure","linuxkernel","servers","tracing"],"first_public_at":"2026-11-02T16:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99238","severity":null,"published_at":"2026-11-02T16:17:49+00:00","modified_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99238:1388","url":null,"severity":null,"published_at":"2026-11-02T16:27:33+00:00","modified_at":"2026-11-02T16:27:33+00:00","first_seen_at":"2026-11-02T16:27:33+00:00","fetched_at":"2026-11-02T16:27:33+00:00","note":"Read the maintainer patch (Carlier 2026-10-16; Rostedt queued it in tracing for-next 'Updates for 7.4' on 2026-10-20, Cc stable). Bug introduced by 5f3719f697c3; the fix is a 2-line guard(mutex)(&trace_types_lock) in trace_module_record(). No released kernel version or stable backport range found, so fixed versions stay unknown. Unprivileged trigger is not stated by the sources; the CVSS vector is local, low privileges."}],"documents":[{"id":52847,"url":"https://lkml.iu.edu/2610.2/10517.html","title":"[for-next][PATCH 2/6] tracing: Hold trace_types_lock when updating modules in persistent instances (Rostedt)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52848,"url":"https://lkml.iu.edu/2610.2/00137.html","title":"[PATCH] tracing: Hold trace_types_lock when updating modules in persistent instances (original report)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}