{"id":"CVE-2026-99247","kind":"vulnerability","aliases":["CVE-2026-99247"],"related":[],"title":"Linux kernel: tracing init can dereference a NULL pointer at boot","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not initialize tracefs work if tracing is disabled\n\nIf trace buffer allocation fails during early boot (e.g.  in\nearly_trace_init() -> allocate_trace_buffers()), tracing_disabled is\nleft set to 1 and the global trace array events list remains\nuninitialized.\n\nLater during boot, tracer_init_tracefs() (invoked via fs_initcall)\nqueues tracerfs_init_work asynchronously without checking if tracing was\ndisabled.  When tracer_init_tracefs_work_func() runs, it calls\nevent_trace_init() and init_tracer_tracefs(&global_trace, NULL)\nunconditionally.  This leads to __find_event_file() dereferencing an\nuninitialized tr->events list, causing an early boot NULL pointer\ndereference Oops:\n\n  BUG: Kernel NULL pointer dereference on read at 0x00000010\n  Faulting instruction address: 0xc000000000485be0\n  Oops: Kernel access of bad area, sig: 7 [#1]\n  ...\n  NIP [c000000000485be0] __find_event_file+0x70/0x3c0\n  LR  [c000000000448874] init_tracer_tracefs+0x274/0xc80\n  Call Trace:\n   init_tracer_tracefs+0x274/0xc80\n   tracer_init_tracefs_work_func+0x50/0x320\n   process_one_work+0x1e8/0x5c0\n   worker_thread+0x1dc/0x3d0\n   kthread+0x194/0x1b0\n   start_kernel_thread+0x14/0x18\n\nCheck tracing_disabled at the beginning of tracer_init_tracefs_work_func()\nand return immediately if tracing is disabled or failed to initialize,\npreventing the crash.","summary":"When trace buffer allocation fails during early boot, the kernel still queues tracefs setup, which reads an uninitialized events list and crashes with a NULL pointer dereference. The fix makes the tracefs setup return early when tracing is disabled.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linux-kernel","servers"],"not_affected_if":["fixed-kernel","trace-allocation-succeeds"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the kernel includes the fix by looking for the commit 'tracing: Do not initialize tracefs work if tracing is disabled' in your kernel source or distribution changelog","fix":null,"status":"open","published_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","triaged_at":"2026-11-03T12:23:00+00:00","updated_at":"2026-11-03T12:23:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T12:23:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: tracing init can dereference a NULL pointer at boot","impact":"low","summary":"When trace buffer allocation fails during early boot, the kernel still queues tracefs setup, which reads an uninitialized events list and crashes with a NULL pointer dereference. The fix makes the tracefs setup return early when tracing is disabled.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","servers","embedded"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Kernel crashes during boot, causing denial of service","analyst_note":"Check the kernel.org stable commit list for the fixed kernel version ranges; the NVD entry gives no fixed version.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the kernel includes the fix by looking for the commit 'tracing: Do not initialize tracefs work if tracing is disabled' in your kernel source or distribution changelog","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-kernel","trace-allocation-succeeds"],"who_is_affected":"The flaw is in the Linux kernel's tracing subsystem during boot, and it only triggers when trace buffer allocation fails early in boot, which is an unusual condition. Systems running affected kernels are exposed to a boot-time crash (denial of service) rather than code execution. Systems on a distribution kernel that already carries this fix, or on unaffected kernel versions, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000756,"input_tokens":4638,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':203C,210C,217C,224C,229C,233C,236C,241C '-2026':13A,16A '-99247':14A,17A '0x00000010':184C '0xc000000000485be0':188C '1':105C,197C '7':196C 'access':191C 'address':187C 'alloc':27B,86C,96C 'area':194C 'array':110C 'asynchron':129C 'bad':193C 'begin':248C 'boot':11A,31B,90C,117C,171C 'buffer':26B,85C,98C 'bug':176C 'c000000000448874':206C 'c000000000485be0':199C 'call':144C,212C 'caus':168C 'check':131C,243C 'crash':45B,268C 'cve':12A,15A 'derefer':6A,50B,174C,180C 'dereferenc':162C 'disabl':62B,82C,100C,135C,245C,261C 'e.g':91C 'earli':30B,58B,89C,93C,170C 'embed':18B 'event':42B,111C,145C,160C,166C,201C 'fail':28B,87C,263C 'fault':185C 'file':161C,202C 'find':159C,200C 'fix':52B 'follow':68C 'fs':123C 'func':141C,223C,254C 'global':108C,152C 'immedi':257C 'infrastructur':19B 'init':4A,95C,119C,127C,138C,147C,149C,207C,214C,220C,251C 'initcal':124C 'initi':76C,265C 'instruct':186C 'invok':121C 'kernel':2A,22B,33B,66C,177C,190C,239C 'kthread':235C 'later':115C 'lead':157C 'left':102C 'linux':1A,21B,65C 'linux-kernel':20B 'list':43B,112C,167C 'lr':205C 'make':53B 'nip':198C 'null':8A,48B,154C,172C,178C 'one':227C 'oop':175C,189C 'pointer':9A,49B,173C,179C 'prevent':266C 'process':226C 'queue':35B,125C 'read':39B,182C 'remain':113C 'resolv':72C 'return':57B,256C 'run':142C 'server':23B 'set':103C 'setup':37B,56B 'sig':195C 'start':238C 'still':34B 'thread':232C,240C 'tr':165C 'trace':3A,25B,60B,73C,80C,84C,94C,97C,99C,109C,133C,146C,153C,213C,244C,259C 'tracef':36B,55B,77C,120C,139C,151C,209C,216C,221C,252C 'tracer':118C,137C,150C,208C,215C,219C,250C 'tracerf':126C 'uncondit':155C 'uniniti':41B,114C,164C 'via':122C 'vulner':69C 'without':130C 'work':78C,128C,140C,222C,228C,253C 'worker':231C 'x14/0x18':242C 'x194/0x1b0':237C 'x1dc/0x3d0':234C 'x1e8/0x5c0':230C 'x274/0xc80':211C,218C 'x50/0x320':225C 'x70/0x3c0':204C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the Linux kernel's tracing subsystem during boot, and it only triggers when trace buffer allocation fails early in boot, which is an unusual condition. Systems running affected kernels are exposed to a boot-time crash (denial of service) rather than code execution. Systems on a distribution kernel that already carries this fix, or on unaffected kernel versions, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","infrastructure","linuxkernel","low","servers"],"first_public_at":"2026-11-03T12:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99247","severity":null,"published_at":"2026-11-03T12:17:31+00:00","modified_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","fetched_at":"2026-11-03T12:20:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}