Описание
In the Linux kernel, the following vulnerability has been resolved:
tracing: Hold trace_types_lock when resetting last boot data from readers
update_last_data_if_empty() is called from tracing_open() with O_TRUNC,
tracing_read_pipe() and tracing_buffers_read() without trace_types_lock.
Two readers can both pass the LAST_BOOT test and free module_delta
twice, and a module notifier can update module_delta while it is being
freed.
Take trace_types_lock in those paths and keep the callers that already
hold it on an unlocked variant.
A flaw was found in the Linux kernel's tracing subsystem. A race condition exists due to missing locking when resetting trace data during concurrent reader operations. A local attacker with access to tracing interfaces can exploit this vulnerability by performing concurrent file operations, triggering memory corruption such as a use-after-free or double-free condition. Successful exploitation could allow an attacker to escalate privileges, execute arbitrary code in the kernel, or cause a Denial of Service (DoS) by crashing the system.
Меры по смягчению последствий
--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to serialize access to last-boot trace data in the kernel tracing subsystem by acquiring trace_types_lock during reader operations: upgrade to the fixed release, which acquire trace_types_lock in update_last_data_if_empty when handling last-boot buffers and route existing locked call sites to an unlocked helper variant, closing all 3 injection vectors (concurrent tracing_read_pipe calls, concurrent tracing_buffers_read operations, concurrent tracing_open calls with O_TRUNC). Until patched, this is only a concern on Linux systems where local users have permissions to read or open tracing filesystem files — Non-Linux operating systems are unaffected — so restrict access permissions on tracefs and debugfs interfaces so unprivileged or untrusted local accounts cannot open or read tracing files. As a compensating measure, enable KASAN to detect kernel use-after-free and double-free conditions at runtime, run SELinux in enforcing mode to block unprivileged and confined domains from opening or reading tracefs files, confine login users through SELinux user mappings to restrict access to administrative kernel tracing interfaces, isolate containerized processes using mount and user namespaces so tracefs is unmounted and inaccessible, drop administrative capabilities from untrusted processes to prevent interaction with restricted tracing interfaces, and deploy Falco or eBPF runtime security agents to detect anomalous read and open operations on tracing subsystem files. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing locking race condition — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.
In the Linux kernel, the following vulnerability has been resolved: t ...
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.
EPSS
7.8 High
CVSS3