CVE-2026-99238

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-99238
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99238.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-99238
Downstream
Related
Published
2026-11-02T16:06:42Z
Modified
2026-11-10T17:27:00Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
tracing: Hold trace_types_lock when updating modules in persistent instances
Details

In the Linux kernel, the following vulnerability has been resolved:

tracing: Hold trace_types_lock when updating modules in persistent instances

trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99238.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43
Fixed
57408eac99b0d8a005796346d317d31f0ca4e07a
Fixed
dab2bd4d67ad5eaa95019a9511f8d379401b5021
Fixed
244c442f54601a24c86ad90572bf36fc3df41c5e
Fixed
66877a312ae3c2c3d849e82e882f642ffd4ec3e2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99238.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.15.0
Fixed
6.18.60
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.14
Type
ECOSYSTEM
Events
Introduced
7.3.0
Fixed
7.3.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99238.json"