Cloudanix VulnDB

CVE-2026-99237

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Nov 2, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how the Linux kernel handles tracing data can let local users corrupt memory and crash or take over the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in kernel tracing allows concurrent calls to update_last_data_if_empty() without trace_types_lock, enabling double-free of module_delta and concurrent modification during free.

Why it matters to the business

Local users on affected Linux kernels can trigger kernel memory corruption leading to crashes, denial of service, or potential privilege escalation, risking system stability and data integrity on servers and endpoints.

How an attack unfolds

An attacker with local access opens tracing files concurrently with O_TRUNC or read operations while a module notifier runs, bypassing the lock to trigger double-free and corruption of module data structures.

How to fix it

Apply the upstream fix that acquires trace_types_lock in tracing_open(), tracing_read_pipe(), and tracing_buffers_read() paths; rebuild and deploy updated kernel packages as soon as vendor releases become available.

How to confirm the fix worked

Verify kernel source contains the lock acquisition around update_last_data_if_empty() calls, confirm no double-free paths remain via static analysis, and test concurrent tracing workloads post-upgrade.

Typical attack path

  1. Obtain local user access on target Linux system
  2. Open tracing interfaces such as trace_pipe or buffers in multiple threads with truncation flags
  3. Trigger module load/unload events to race with the unprotected last-boot data reset
  4. Exploit resulting double-free for memory corruption or code execution

How to detect it

Review kernel logs for oops or panic messages involving module_delta or tracing locks; inspect audit logs for concurrent tracing file opens by the same user; correlate with module load events.

What your security team should do

  • Prioritize kernel updates on all multi-user or exposed Linux systems within the next patch cycle
  • Restrict unprivileged access to /sys/kernel/tracing and related interfaces via permissions or SELinux policies
  • Monitor for unusual tracing activity and kernel oops reports indicating memory corruption

The record

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.

Affected packages

Ecosystem Package Introduced Fixed