{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-99238", "modified": "2026-11-03T05:30:01Z", "upstream": [ "CVE-2026-99238" ], "published": "2026-11-02T15:14:24Z", "summary": "tracing: Hold trace_types_lock when updating modules in persistent instances", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.60" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.60" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.60" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.60" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.60" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-99238" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-11-02T16:03:24Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - trace_module_record() is reached only from trace_module_notify() on MODULE_STATE_COMING/GOING via load_module()->prepare_coming_module() or delete_module(), i.e. local finit_module/init_module/delete_module or __sock_create()'s request_module(\"net-pf-%d\"). The concurrent free is rmdir(2) on tracefs instances (tracefs_syscall_rmdir()->instance_rmdir()). No protocol message carries the list pointer.\nAC:L - The attacker mkdir()s an instance, then concurrently rmdir()s it so __remove_instance() list_del()+kfree()s the trace_array while another thread loads or unloads a module and trace_module_record() walks ftrace_trace_arrays unlocked. They drive both sides and can retry; a boot/persistent instance is unnecessary because the walk visits every trace_array before checking TRACE_ARRAY_FL_BOOT.\nPR:L - instance_mkdir()/instance_rmdir() (via tracefs_syscall_rmdir) check only VFS DAC on the 0750 instances directory and LOCKDOWN_TRACEFS, not capable(). tracefs_parse_param() uid=/gid= makes a non-root owner of that directory. The COMING notifier also runs after __sock_create()'s request_module(\"net-pf-%d\"), which is not gated by CAP_SYS_MODULE.\nUI:N - The attacker mkdir/rmdir their own /sys/kernel/tracing/instances/ and starts the module load or unload (socket() autoload, finit_module, or delete_module) on their own threads. No other user must mount media, open a file, or confirm the action.\nS:U - __remove_instance() kfree()s a host-kernel struct trace_array that trace_module_record() still walks on ftrace_trace_arrays. The resulting heap corruption stays in the tracing subsystem on that host and does not cross a VM, IOMMU, or guest/host boundary.\nC:H - After __remove_instance() kfree()s the kzalloc'd trace_array, trace_module_record() still reads tr->flags and list_for_each_entry follows tr->list.next. Reclaiming that object lets the attacker control those fields and the later tr->scratch/tr->module_delta pointers, which is a use-after-free kernel read.\nI:H - If the reclaimed object's flags include TRACE_ARRAY_FL_BOOT, save_mod() writes mod->name and mod_addr through attacker-controlled tr->scratch; if TRACE_ARRAY_FL_LAST_BOOT is set, make_mod_delta() writes tr->module_delta->delta[]. That use-after-free write is a kernel heap and control-flow primitive.\nA:H - list_for_each_entry on the kfree'd trace_array in trace_module_record(), or save_mod()/make_mod_delta() dereferencing stale tr->scratch, oopses or panics the kernel. The attacker can repeat the rmdir-versus-module-notifier race until that crash hits." } } }