CVE-2026-99232: tracing/syscalls: Use copy_from_user for the faultable syscall buffer
Published Nov 2, 2026
·
Updated
In the Linux kernel, the following vulnerability has been resolved:
tracing/syscalls: Use copyfromuser for the faultable syscall buffer
syscallcopyuserarray() copies the buffer argument of faultable
syscalls (write, pwrite64, ...) with copyfromuser(), which skips
accessok(). Use copyfromuser() instead so a non-user address is
rejected and the entry is recorded as faulted.
It could be a security concern for machines that trust perf a bit too
much.
SecAlerts Pty Ltd. 132 Wickham Terrace Fortitude Valley, QLD 4006, Australia info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
Which Ubuntu kernel package variants are identified as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
2
What environment is most relevant to the security concern?
The issue is specifically described as a concern for machines that trust perf too much. It involves syscall tracing of faultable syscalls such as write and pwrite64 when handling a buffer argument that is not a valid user address.