← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99237

2 November 2026

update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.

Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.

Introduced

6.16 32dc0042528d385d83bf458e4cf3a49c5110afea

Fixed releases

6.18.60 92b69f6db640dadc0851762ee2e12db99f083cad

7.2.14 d6d991afe775ab7fcf89523a2502b7ca3be56ffd

7.3.1 1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa

View source announcement ↗