Описание
In the Linux kernel, the following vulnerability has been resolved:
tracing: Hold trace_types_lock when updating modules in persistent instances
trace_module_record() walks ftrace_trace_arrays from the module notifier
without trace_types_lock. A concurrent rmdir of an instance removes it
from the list and frees it under that lock, so a module load or unload
can walk into a freed trace_array.
A flaw was found in the Linux kernel's tracing subsystem. A local attacker could exploit this vulnerability to achieve privilege escalation or cause a Denial of Service (DoS) by crashing the system. The issue is caused by a race condition where module records are updated without acquiring the proper lock during module loading or unloading. This missing synchronization allows a concurrently removed tracing instance to be accessed after being freed, resulting in a use-after-free condition.
Отчет
This vulnerability is rated as Important severity because an attacker with local access who can manage tracing instances can exploit a race condition during dynamic module events to trigger memory corruption, potentially escalating privileges to the kernel level or causing a system crash. In standard Red Hat Enterprise Linux deployments, access to the tracefs hierarchy is restricted to privileged administrators by default, which substantially limits the exposure to non-root users. The flaw specifically requires write permissions to create and delete directory structures within the tracing instances pseudo-filesystem.
Меры по смягчению последствий
--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to acquire trace_types_lock before traversing ftrace_trace_arrays in trace_module_record during module loading or unloading: upgrade to the fixed release, which acquire trace_types_lock with a mutex guard before iterating over ftrace_trace_arrays in trace_module_record(), closing concurrent tracefs instance removal during module loading or unloading. Until patched, this is only a concern on Linux systems where local authenticated users can modify tracefs directory structures and trigger module loading or unloading — Non-Linux operating systems are unaffected — so Restrict write permissions to tracefs hierarchy directories, drop CAP_SYS_ADMIN, and restrict dynamic kernel module loading and unloading. As a compensating measure, audit syscalls targeting tracefs directory removal and module loading events, detect anomalous privilege escalation and tracing manipulation using eBPF probes, detect kernel use-after-free memory dereferences with runtime memory error detection, enforce non-executable permissions on kernel heap structures using the NX/XD bit, randomize kernel code locations with KASLR to hinder control-flow redirection, and prevent kernel execution of userspace code during privilege escalation via SMEP. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free race condition defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-107 Kernel Module Loading Restriction (high)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.8 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array.
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array.
In the Linux kernel, the following vulnerability has been resolved: t ...
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array.
7.8 High
CVSS3