DEBIAN-CVE-2026-99238: High severity debian/linux vulnerability

Published Nov 2, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord() walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed tracearray.

Affected Software

1 affected component

debian/linux*

Event History

Nov 2, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability has local attack vector, low attack complexity, and requires low privileges. No user interaction is required.

What race condition triggers the vulnerability?

A module load or unload can invoke trace_module_record() while a concurrent rmdir removes and frees a tracing instance. Without trace_types_lock held during the module-notifier walk, the code can access a freed trace_array.

What is the potential impact?

The listed severity is high, with high impact to confidentiality, integrity, and availability. Successful exploitation could therefore expose or alter data or cause denial of service.

DEBIAN-CVE-2026-99238: High severity debian/linux vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What race condition triggers the vulnerability?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What race condition triggers the vulnerability?

What is the potential impact?