Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-02T16:06:39 kernel: kernel: Information disclosure via improper memory address validation in syscall tracing 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-822

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copy_from_user for the faultable syscall buffer syscall_copy_user_array() copies the buffer argument of faultable syscalls (write, pwrite64, ...) with __copy_from_user(), which skips access_ok(). Use copy_from_user() instead so a non-user address is rejected and the entry is recorded as faulted. It could be a security concern for machines that trust perf a bit too much.

A flaw was found in the Linux kernel. A local attacker can trigger this issue by invoking faultable system calls with non-user memory addresses while tracing is active. Because the kernel fails to verify that the source address resides in user space before copying data into trace buffers, this flaw may lead to information disclosure of sensitive kernel memory.

This vulnerability is rated as Moderate severity because exploitation is confined to local environments and depends on active syscall tracing, which is disabled by default on standard Red Hat Enterprise Linux installations. An unprivileged local user cannot trigger trace event capture unless an administrator or privileged monitoring process explicitly enables tracing of faultable system calls. While unauthorized disclosure of kernel memory could expose sensitive system details, the defect does not allow arbitrary privilege escalation or system disruption directly. Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99232 https://nvd.nist.gov/vuln/detail/CVE-2026-99232 https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69 https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105