CVE-2026-99237
Description
A flaw was found in the Linux kernel's tracing subsystem. A race condition exists due to missing locking when resetting trace data during concurrent reader operations. A local attacker with access to tracing interfaces can exploit this vulnerability by performing concurrent file operations, triggering memory corruption such as a use-after-free or double-free condition. Successful exploitation could allow an attacker to escalate privileges, execute arbitrary code in the kernel, or cause a Denial of Service (DoS) by crashing the system.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to serialize access to last-boot trace data in the kernel tracing subsystem by acquiring trace_types_lock during reader operations: upgrade to the fixed release, which acquire trace_types_lock in update_last_data_if_empty when handling last-boot buffers and route existing locked call sites to an unlocked helper variant, closing all 3 injection vectors (concurrent tracing_read_pipe calls, concurrent tracing_buffers_read operations, concurrent tracing_open calls with O_TRUNC). Until patched, this is only a concern on Linux systems where local users have permissions to read or open tracing filesystem files — Non-Linux operating systems are unaffected — so restrict access permissions on tracefs and debugfs interfaces so unprivileged or untrusted local accounts cannot open or read tracing files. As a compensating measure, enable KASAN to detect kernel use-after-free and double-free conditions at runtime, run SELinux in enforcing mode to block unprivileged and confined domains from opening or reading tracefs files, confine login users through SELinux user mappings to restrict access to administrative kernel tracing interfaces, isolate containerized processes using mount and user namespaces so tracefs is unmounted and inaccessible, drop administrative capabilities from untrusted processes to prevent interaction with restricted tracing interfaces, and deploy Falco or eBPF runtime security agents to detect anomalous read and open operations on tracing subsystem files. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing locking race condition — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
