CVE-2026-97933
Received Received - Intake

Use-After-Free in Linux Kernel Tracing Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the trace_array's topts array. This element has information to find the trace array and other information. It uses this element to take a reference of the trace_array so that the trace_array does not get removed while this file is opened. Unfortunately, there's a race condition where the element itself could be freed by the removal of the instance the trace_array represents causing a use-after-free as this element that is used to find the trace_array to increment its reference counter is also freed when the instance is removed. To solve this, add a trace_array_tracer_options_get() helper function that will take the address of the element that is passed to the open function by the inode->i_private pointer and search all the trace_arrays under a lock to find the one that the element's address is in the range of the trace_arrays topts array elements. When a match happens, that trace_array's reference would be increased. Note, there's a race where if an admin was deleting and creating trace instances at the same time and the memory of the old trace_array's array matched the memory of the new trace_array that it could in theory open the option from the wrong trace array. But we do not care because it would be stupid to perform that kind of action. As long as the only thing that can happen is that the option from the wrong trace array is used and doesn't crash the kernel it will only make the user confused. But if they are doing something stupid like this, they are already confused, so no harm done.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97933
EUVD
EUVD-2026-86787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's tracing subsystem. When a tracer option file is opened, it references an element in the trace_array's topts array to maintain a reference to the trace_array. However, a race condition exists where the element could be freed during the removal of the trace instance, leading to a use-after-free scenario. The fix involves adding a helper function to safely locate and reference the correct trace_array.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and requires kernel-level inspection. Detection involves checking kernel logs for trace_array use-after-free errors or kernel crashes related to tracer option files. Commands like dmesg | grep -i trace or journalctl -k | grep -i trace may help identify issues. However, no direct detection commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to cause a kernel crash or execute arbitrary code with kernel privileges by exploiting the use-after-free condition. This may lead to denial-of-service or potential privilege escalation on affected systems.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the primary mitigation. Monitor kernel security advisories for updates related to CVE-2026-97933.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97933. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart