GHSA-92RV-C2P9-QP48
Vulnerability from github – Published: 2026-11-03 12:31 – Updated: 2026-11-03 12:31In the Linux kernel, the following vulnerability has been resolved:
tracing: Do not initialize tracefs work if tracing is disabled
If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is left set to 1 and the global trace array events list remains uninitialized.
Later during boot, tracer_init_tracefs() (invoked via fs_initcall) queues tracerfs_init_work asynchronously without checking if tracing was disabled. When tracer_init_tracefs_work_func() runs, it calls event_trace_init() and init_tracer_tracefs(&global_trace, NULL) unconditionally. This leads to __find_event_file() dereferencing an uninitialized tr->events list, causing an early boot NULL pointer dereference Oops:
BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000485be0 Oops: Kernel access of bad area, sig: 7 [#1] ... NIP [c000000000485be0] __find_event_file+0x70/0x3c0 LR [c000000000448874] init_tracer_tracefs+0x274/0xc80 Call Trace: init_tracer_tracefs+0x274/0xc80 tracer_init_tracefs_work_func+0x50/0x320 process_one_work+0x1e8/0x5c0 worker_thread+0x1dc/0x3d0 kthread+0x194/0x1b0 start_kernel_thread+0x14/0x18
Check tracing_disabled at the beginning of tracer_init_tracefs_work_func() and return immediately if tracing is disabled or failed to initialize, preventing the crash.
{
"affected": [],
"aliases": [
"CVE-2026-99247"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-03T12:17:31Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not initialize tracefs work if tracing is disabled\n\nIf trace buffer allocation fails during early boot (e.g. in\nearly_trace_init() -\u003e allocate_trace_buffers()), tracing_disabled is\nleft set to 1 and the global trace array events list remains\nuninitialized.\n\nLater during boot, tracer_init_tracefs() (invoked via fs_initcall)\nqueues tracerfs_init_work asynchronously without checking if tracing was\ndisabled. When tracer_init_tracefs_work_func() runs, it calls\nevent_trace_init() and init_tracer_tracefs(\u0026global_trace, NULL)\nunconditionally. This leads to __find_event_file() dereferencing an\nuninitialized tr-\u003eevents list, causing an early boot NULL pointer\ndereference Oops:\n\n BUG: Kernel NULL pointer dereference on read at 0x00000010\n Faulting instruction address: 0xc000000000485be0\n Oops: Kernel access of bad area, sig: 7 [#1]\n ...\n NIP [c000000000485be0] __find_event_file+0x70/0x3c0\n LR [c000000000448874] init_tracer_tracefs+0x274/0xc80\n Call Trace:\n init_tracer_tracefs+0x274/0xc80\n tracer_init_tracefs_work_func+0x50/0x320\n process_one_work+0x1e8/0x5c0\n worker_thread+0x1dc/0x3d0\n kthread+0x194/0x1b0\n start_kernel_thread+0x14/0x18\n\nCheck tracing_disabled at the beginning of tracer_init_tracefs_work_func()\nand return immediately if tracing is disabled or failed to initialize,\npreventing the crash.",
"id": "GHSA-92rv-c2p9-qp48",
"modified": "2026-11-03T12:31:49Z",
"published": "2026-11-03T12:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99247"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7539c61f522ff693d9565a0411386c2236e776cd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/813e18881c6472eb229a63180ff42c808e3e949b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/afd38b10b1c6a5c5d6952b15b990596dab9684e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b3b974008388ab59e44d764ba7a63c988fec2524"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8665e884e076d894f3eed8b9ea28e37a6448604"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8cfcd7e60eaa3b0dea4d71c64499604e7081736"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.