Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-11-02T16:06:42 kernel: kernel: privilege escalation via race condition in tracing subsystem 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-366

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.

A flaw was found in the Linux kernel's tracing subsystem. A race condition exists due to missing locking when resetting trace data during concurrent reader operations. A local attacker with access to tracing interfaces can exploit this vulnerability by performing concurrent file operations, triggering memory corruption such as a use-after-free or double-free condition. Successful exploitation could allow an attacker to escalate privileges, execute arbitrary code in the kernel, or cause a Denial of Service (DoS) by crashing the system.

--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to serialize access to last-boot trace data in the kernel tracing subsystem by acquiring trace_types_lock during reader operations: upgrade to the fixed release, which acquire trace_types_lock in update_last_data_if_empty when handling last-boot buffers and route existing locked call sites to an unlocked helper variant, closing all 3 injection vectors (concurrent tracing_read_pipe calls, concurrent tracing_buffers_read operations, concurrent tracing_open calls with O_TRUNC). Until patched, this is only a concern on Linux systems where local users have permissions to read or open tracing filesystem files — Non-Linux operating systems are unaffected — so restrict access permissions on tracefs and debugfs interfaces so unprivileged or untrusted local accounts cannot open or read tracing files. As a compensating measure, enable KASAN to detect kernel use-after-free and double-free conditions at runtime, run SELinux in enforcing mode to block unprivileged and confined domains from opening or reading tracefs files, confine login users through SELinux user mappings to restrict access to administrative kernel tracing interfaces, isolate containerized processes using mount and user namespaces so tracefs is unmounted and inaccessible, drop administrative capabilities from untrusted processes to prevent interaction with restricted tracing interfaces, and deploy Falco or eBPF runtime security agents to detect anomalous read and open operations on tracing subsystem files. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing locking race condition — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium) Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99237 https://nvd.nist.gov/vuln/detail/CVE-2026-99237 https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd