NULL pointer dereference in Linux kernel tracefs initialization
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The Linux kernel from 5.19 starts tracefs tracing work even when tracing was disabled after a failed early boot buffer allocation. This leaves the trace event list uninitialized and causes a NULL pointer dereference that crashes the kernel during boot.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is left set to 1 and the global trace array events list remains uninitialized. Later during boot, tracer_init_tracefs() (invoked via fs_initcall) queues tracerfs_init_work asynchronously without checking if tracing was disabled. When tracer_init_tracefs_work_func() runs, it calls event_trace_init() and init_tracer_tracefs(&global_trace, NULL) unconditionally. This leads to __find_event_file() dereferencing an uninitialized tr->events list, causing an early boot NULL pointer dereference Oops: BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000485be0 Oops: Kernel access of bad area, sig: 7 [#1] ... NIP [c000000000485be0] __find_event_file+0x70/0x3c0 LR [c000000000448874] init_tracer_tracefs+0x274/0xc80 Call Trace: init_tracer_tracefs+0x274/0xc80 tracer_init_tracefs_work_func+0x50/0x320 process_one_work+0x1e8/0x5c0 worker_thread+0x1dc/0x3d0 kthread+0x194/0x1b0 start_kernel_thread+0x14/0x18 Check tracing_disabled at the beginning of tracer_init_tracefs_work_func() and return immediately if tracing is disabled or failed to initialize, preventing the crash.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
The fixed Linux kernel versions are 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13 and 7.3.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3
Timeline
- 2026-11-03 Threatist record created from CVE-2026-99247
- 2026-11-03 Alias added: GHSA-92rv-c2p9-qp48
References
Other 6
- https://git.kernel.org/stable/c/e8665e884e076d894f3eed8b9ea28e37a6448604
- https://git.kernel.org/stable/c/e8cfcd7e60eaa3b0dea4d71c64499604e7081736
- https://git.kernel.org/stable/c/afd38b10b1c6a5c5d6952b15b990596dab9684e6
- https://git.kernel.org/stable/c/813e18881c6472eb229a63180ff42c808e3e949b
- https://git.kernel.org/stable/c/7539c61f522ff693d9565a0411386c2236e776cd
- https://git.kernel.org/stable/c/b3b974008388ab59e44d764ba7a63c988fec2524
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-99247 · CVE Program
- CVE-2026-99247 · NVD
- FIRST EPSS
- GHSA-92rv-c2p9-qp48 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences