CVE-2026-21991 Path traversal in Oracle Linux

Medium 5.5 Published 16 Mar 2026 Updated 17 Mar 2026

An attacker can create arbitrary files via crafted USDT provider names in the DTrace dtprobed component on Oracle Linux.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-21991?

CVE-2026-21991 is a medium-severity path traversal vulnerability in Oracle Linux, published on 16 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.

Weakness: CWE-22

Which versions are affected by CVE-2026-21991?

It affects 1 product.

Products include Oracle Linux.

How do I fix CVE-2026-21991?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-21991 being exploited?

There is no known exploitation of CVE-2026-21991 in the wild and no public exploit code.

All Oracle Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-21991, GHSA-m3x9-92c9-624c.