{"id":"CVE-2026-99238","summary":"tracing: Hold trace_types_lock when updating modules in persistent instances","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Hold trace_types_lock when updating modules in persistent instances\n\ntrace_module_record() walks ftrace_trace_arrays from the module notifier\nwithout trace_types_lock. A concurrent rmdir of an instance removes it\nfrom the list and frees it under that lock, so a module load or unload\ncan walk into a freed trace_array.","modified":"2026-11-10T17:27:00.446420329Z","published":"2026-11-02T16:06:42.810Z","related":["openSUSE-SU-2026:12497-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99238.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/66877a312ae3c2c3d849e82e882f642ffd4ec3e2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99238.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99238"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5f3719f697c3fdfae5cd6805f10ac7a04b0f4e43"},{"fixed":"57408eac99b0d8a005796346d317d31f0ca4e07a"},{"fixed":"dab2bd4d67ad5eaa95019a9511f8d379401b5021"},{"fixed":"244c442f54601a24c86ad90572bf36fc3df41c5e"},{"fixed":"66877a312ae3c2c3d849e82e882f642ffd4ec3e2"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99238.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.15.0"},{"fixed":"6.18.60"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99238.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}