Cloudanix VulnDB

CVE-2026-99232

None

CVSS

—

EPSS

0.2%

Published

Nov 2, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A tracing feature inside the Linux kernel could let certain memory addresses slip past checks, creating a stability or security risk on systems that rely heavily on performance monitoring tools.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The syscall_copy_user_array helper for faultable syscalls (write, pwrite64, etc.) calls __copy_from_user instead of copy_from_user, bypassing access_ok validation and allowing a non-user address to be dereferenced during perf syscall tracing.

Why it matters to the business

Organizations running recent Linux kernels with perf tracing enabled face elevated risk of kernel instability or unexpected behavior when untrusted or misconfigured tracing workloads are present; the issue is one day old with no known public exploits.

How an attack unfolds

An attacker with the ability to influence perf tracing configuration supplies a syscall buffer whose address is not a valid user pointer; because access_ok is skipped the kernel proceeds with the copy, potentially recording the entry as faulted or triggering undefined behavior.

How to fix it

Upgrade to a Linux kernel containing the fix that replaces __copy_from_user with copy_from_user inside syscall_copy_user_array; apply the vendor-supplied update as soon as it is available for your distribution.

How to confirm the fix worked

Confirm the running kernel source contains the change from __copy_from_user to copy_from_user in the syscall tracing code path; re-test perf tracing of write-family syscalls with deliberately invalid addresses to verify access_ok enforcement.

Typical attack path

  1. Obtain sufficient privileges to configure perf syscall tracing
  2. Register a tracing probe on a faultable syscall
  3. Supply a non-user address as the syscall buffer argument
  4. Trigger the traced syscall to exercise the flawed copy path

How to detect it

Inspect kernel audit logs and perf event records for unexpected faulted syscall entries originating from non-user addresses; correlate with any recent perf configuration changes or tracing sessions.

What your security team should do

  • Prioritize kernel updates for all systems that enable perf tracing of syscalls
  • Review perf usage policies and reduce unnecessary tracing privileges
  • Monitor upstream stable kernel releases for the backported fix

The record

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copy_from_user for the faultable syscall buffer syscall_copy_user_array() copies the buffer argument of faultable syscalls (write, pwrite64, ...) with __copy_from_user(), which skips access_ok(). Use copy_from_user() instead so a non-user address is rejected and the entry is recorded as faulted. It could be a security concern for machines that trust perf a bit too much.

Affected packages

Ecosystem Package Introduced Fixed