VulnerabilityPublished 28 Oct 2026

CVE-2026-99141: Linux kernel · tracing: Fix crash in print_graph_function_event()

Source GCVE Database

Authoritative record:CVE-2026-99141

Not known to be exploited : upgrade to b1547c6ba93b8863010aa324cd20c441f886f23e or 3cc117514d69067a94d6c7479730dce41e678f50 when convenient.

Data as of 28 Oct 2026, 14:01 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in b1547c6ba93b8863010aa324cd20c441f886f23e, 3cc117514d69067a94d6c7479730dce41e678f50

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-jfp7-c7j3-v9pj

What to do

Upgrade Linux kernel to b1547c6ba93b8863010aa324cd20c441f886f23e or 3cc117514d69067a94d6c7479730dce41e678f50.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e29aa918a928408c3e64b0d1025e4eb9f6fc549e, < b1547c6ba93b8863010aa324cd20c441f886f23e	Fixed in b1547c6ba93b8863010aa324cd20c441f886f23e
LinuxLinux	Affected ≥ e29aa918a928408c3e64b0d1025e4eb9f6fc549e, < 3cc117514d69067a94d6c7479730dce41e678f50	Fixed in 3cc117514d69067a94d6c7479730dce41e678f50
LinuxLinux	Affected =6.19	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to prevent current_trace_flags from being NULL by providing a fallback empty flag set. Users should update to the fixed kernel version once available. Until then, avoid switching to tracers that define no flags or avoid using the affected tracing features under stress conditions.

Description

A vulnerability in the Linux kernel tracing subsystem could cause a kernel crash (NULL pointer dereference) when switching tracers under certain conditions. This occurs if the newly selected tracer has no flags defined, leading to a NULL pointer dereference during printing of function graph events. The issue was observed during stress testing of ftrace and can be reproduced by switching tracers without resetting the snapshot buffer.

Impact

This vulnerability can cause a kernel NULL pointer dereference leading to a crash (kernel panic) when using the tracing subsystem with certain tracers. This can disrupt system stability and availability during tracing operations, particularly under stress testing or specific tracer switching scenarios.

Summary

The Linux kernel tracing subsystem's function tracing code had a flaw where switching to a tracer that defines neither static nor default flags (such as hwlat, irqsoff, or wakeup) results in the current_trace_flags pointer being NULL. Since the ring buffer is not cleared when switching tracers, printing function graph entries from the previous tracer dereferences this NULL pointer, causing a kernel crash. The fix ensures current_trace_flags never becomes NULL by falling back to a static empty flag set when no flags are defined by the new tracer.

References

Community reviews

Loading reviews…