CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access

Published Aug 10, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Add global mutex to serialize traceparser access

In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input.

The affected handler paths and their specific functions are: - Open paths: ftraceregexopen(), ftracegraphopen() - Write paths: ftraceregexwrite(), ftracegraphwrite() - Release paths: ftraceregexrelease(), ftracegraphrelease()

If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior.

Fix this by adding a global mutex, parserlock, to serialize all access to traceparser across write and release paths, preventing concurrent corruption of parser state.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Ensure trace file descriptors opened in userspace are not shared across multiple threads/processes; each thread should open and use its own ftrace trace file descriptor rather than reusing the same descriptor across concurrent open/write/release operations.

Event History

Aug 10, 2026
CVE Published
via MITRE·11:59 AM
Data Sourced
via MITRE·11:59 AM
Description
Data Sourced
via NVD·01:20 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-68146?

CVE-2026-68146 has a risk rating of 22.

2

How do I fix CVE-2026-68146?

To fix CVE-2026-68146, ensure you update your Linux kernel to the latest patched version that addresses the vulnerability.

3

What impact does CVE-2026-68146 have on system security?

CVE-2026-68146 could allow unauthorized access to trace_parser structures, potentially leading to information leakage or unexpected behavior.

4

Is CVE-2026-68146 a remote vulnerability?

CVE-2026-68146 is not a remote vulnerability; it requires local access to exploit.

5

When was CVE-2026-68146 published?

CVE-2026-68146 was published on August 10, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203