CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Add global mutex to serialize traceparser access
In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input.
The affected handler paths and their specific functions are: - Open paths: ftraceregexopen(), ftracegraphopen() - Write paths: ftraceregexwrite(), ftracegraphwrite() - Release paths: ftraceregexrelease(), ftracegraphrelease()
If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior.
Fix this by adding a global mutex, parserlock, to serialize all access to traceparser across write and release paths, preventing concurrent corruption of parser state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure trace file descriptors opened in userspace are not shared across multiple threads/processes; each thread should open and use its own ftrace trace file descriptor rather than reusing the same descriptor across concurrent open/write/release operations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68146?
CVE-2026-68146 has a risk rating of 22.
How do I fix CVE-2026-68146?
To fix CVE-2026-68146, ensure you update your Linux kernel to the latest patched version that addresses the vulnerability.
What impact does CVE-2026-68146 have on system security?
CVE-2026-68146 could allow unauthorized access to trace_parser structures, potentially leading to information leakage or unexpected behavior.
Is CVE-2026-68146 a remote vulnerability?
CVE-2026-68146 is not a remote vulnerability; it requires local access to exploit.
When was CVE-2026-68146 published?
CVE-2026-68146 was published on August 10, 2026.