Live › vulnerability › CVE-2026-99247
When trace buffer allocation fails during early boot, the kernel still queues tracefs setup, which reads an uninitialized events list and crashes with a NULL pointer dereference. The fix makes the tracefs setup return early when tracing is disabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
The flaw is in the Linux kernel's tracing subsystem during boot, and it only triggers when trace buffer allocation fails early in boot, which is an unusual condition. Systems running affected kernels are exposed to a boot-time crash (denial of service) rather than code execution. Systems on a distribution kernel that already carries this fix, or on unaffected kernel versions, can skip it.
No product ranges from the sources yet.
uname -r to see the running kernel versionUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tracing: Do not initialize tracefs work if tracing is disabled
If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is left set to 1 and the global trace array events list remains uninitialized.
Later during boot, tracer_init_tracefs() (invoked via fs_initcall) queues tracerfs_init_work asynchronously without checking if tracing was disabled. When tracer_init_tracefs_work_func() runs, it calls event_trace_init() and init_tracer_tracefs(&global_trace, NULL) unconditionally. This leads to __find_event_file() dereferencing an uninitialized tr->events list, causing an early boot NULL pointer dereference Oops:
BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000485be0 Oops: Kernel access of bad area, sig: 7 [#1] ... NIP [c000000000485be0] __find_event_file+0x70/0x3c0 LR [c000000000448874] init_tracer_tracefs+0x274/0xc80 Call Trace: init_tracer_tracefs+0x274/0xc80 tracer_init_tracefs_work_func+0x50/0x320 process_one_work+0x1e8/0x5c0 worker_thread+0x1dc/0x3d0 kthread+0x194/0x1b0 start_kernel_thread+0x14/0x18
Check tracing_disabled at the beginning of tracer_init_tracefs_work_func() and return immediately if tracing is disabled or failed to initialize, preventing the crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-99247")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.