AZL-112535: CVE-2026-99219 affecting package kernel 6.6.159.1-1

Q: What condition is required to trigger the fault?

The affected system must read available_filter_functions while a kernel module is being loaded or unloaded. In that timing window, kallsyms_lookup() can fail and leave values used by print_rec() uninitialized.

Q: What is the practical impact of a failed lookup?

A garbage modname value can pass a null check and be dereferenced by seq_printf(), resulting in a general protection fault. The provided trace indicates this can crash the kernel path handling the read.

Q: How can I determine whether a system is exposed to this trigger?

Check whether the installed Azure Linux kernel package is version 6.6.159.1-1, as identified in the advisory. Systems where available_filter_functions may be read during module load or unload activity are subject to the described race condition.

Published Nov 2, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Initialize modname and offset in printrec()

printrec() leaves 'modname' and 'offset' uninitialized and kallsymslookup() only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seqprintf().

Oops: general protection fault RIP: 0010:string+0x48/0xe0 Call Trace: vsnprintf+0x1f5/0x650 seqprintf+0x8e/0xb0 printrec+0x6c/0xc0 tshow+0x4c/0x440 seqreaditer+0x119/0x480

This can be triggered by reading availablefilterfunctions while a module is being loaded or unloaded.

Initialize both variables so a failed lookup skips the module name.

Affected Software

1 affected component

azure-linux/kernel<=6.6.159.1-1

Event History

Nov 2, 2026

Advisory Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99219

Frequently Asked Questions

What condition is required to trigger the fault?

The affected system must read available_filter_functions while a kernel module is being loaded or unloaded. In that timing window, kallsyms_lookup() can fail and leave values used by print_rec() uninitialized.

What is the practical impact of a failed lookup?

A garbage modname value can pass a null check and be dereferenced by seq_printf(), resulting in a general protection fault. The provided trace indicates this can crash the kernel path handling the read.

How can I determine whether a system is exposed to this trigger?

Check whether the installed Azure Linux kernel package is version 6.6.159.1-1, as identified in the advisory. Systems where available_filter_functions may be read during module load or unload activity are subject to the described race condition.

AZL-112535: CVE-2026-99219 affecting package kernel 6.6.159.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What condition is required to trigger the fault?

What is the practical impact of a failed lookup?

How can I determine whether a system is exposed to this trigger?

Company

Resources

Contact

Frequently Asked Questions

What condition is required to trigger the fault?

What is the practical impact of a failed lookup?

How can I determine whether a system is exposed to this trigger?