Linux Kernel: Trace Array UAF via Module Load/Unload in Persistent Instances
CVE-2026-99238 Published on November 2, 2026
tracing: Hold trace_types_lock when updating modules in persistent instances
In the Linux kernel, the following vulnerability has been resolved:
tracing: Hold trace_types_lock when updating modules in persistent instances
trace_module_record() walks ftrace_trace_arrays from the module notifier
without trace_types_lock. A concurrent rmdir of an instance removes it
from the list and frees it under that lock, so a module load or unload
can walk into a freed trace_array.
Products Associated with CVE-2026-99238
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43 and below 57408eac99b0d8a005796346d317d31f0ca4e07a is affected.
- Version 5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43 and below dab2bd4d67ad5eaa95019a9511f8d379401b5021 is affected.
- Version 5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43 and below 244c442f54601a24c86ad90572bf36fc3df41c5e is affected.
- Version 6.15 is affected.
- Before 6.15 is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.