{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99140 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99140 is a vulnerability in Linux, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99140 and fix it if it is affected.\n\nWhat it is: CVE-2026-99140 is a vulnerability in Linux, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99140 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99140/ (Markdown: https://insights.sbomify.com/CVE-2026-99140/index.md)","id":"CVE-2026-99140","markdown":"https://insights.sbomify.com/CVE-2026-99140/index.md","name":"CVE-2026-99140","record":{"aliases":["AZL-111266","BELL-CVE-2026-99140","DEBIAN-CVE-2026-99140","GHSA-jpcj-q7f6-fxvj","UBUNTU-CVE-2026-99140"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix hist trigger timestamps for buffered events\n\nSyzkaller triggered a WARN_ON_ONCE(!nest) warning:\n\n  WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp\n  Call trace:\n    ring_buffer_event_time_stamp\n    hist_field_timestamp\n    hist_fn_call\n    event_hist_trigger\n    event_triggers_call\n    __event_trigger_test_discard\n    trace_event_buffer_commit\n    do_trace_event_raw_event_sched_switch\n    trace_event_raw_event_sched_switch\n\nThe warning is probabilistically reproducible and is related to syzkaller\nexecuting the following commands:\n\n  echo 'prev_pid == 999999' \u003e events/sched/sched_switch/filter\n  echo 'hist:keys=common_timestamp' \u003e events/sched/sched_switch/trigger\n\nThe specific triggering process is as follows:\n\nCPU 0                                           CPU 1\n(context switching)                             (echo 'hist:keys=common_timestamp' \u003e \\\n                                                        events/sched/sched_switch/trigger)\ndo_trace_event_raw_event_##call\n  trace_event_buffer_lock_reserve\n    if (!tr-\u003eno_filter_buffering_ref \u0026\u0026\n        trace_file-\u003eflags \u0026 EVENT_FILE_FL_FILTERED)\n        return entry;  // return directly\n                                                event_hist_trigger_parse\n                                                  hist_register_trigger\n                                                    tracing_set_filter_buffering(file-\u003etr, true);\n                                                      tr-\u003eno_filter_buffering_ref++;\n    __trace_buffer_lock_reserve\n      rb_start_commit\n        local_inc(\u0026cpu_buffer-\u003ecommitting);  // skipped and not executed\n  trace_event_buffer_commit\n    __event_trigger_test_discard\n      event_triggers_call\n        event_hist_trigger\n          hist_fn_call\n            hist_field_timestamp\n              ring_buffer_event_time_stamp\n                nest = local_read(\u0026cpu_buffer-\u003ecommitting);\n                WARN_ON_ONCE(!nest)  // trigger warning\n\nThe root cause is that when an event file has a filter attached and the\nhist trigger has not yet been attached, trace_event_buffer_lock_reserve()\nwrites the event into the per-CPU trace_buffered_event temp buffer instead\nof reserving it in the ring buffer, so cpu_buffer-\u003ecommitting is not\nincremented. When the event is later processed at commit time by a hist\ntrigger, hist_field_timestamp() -\u003e ring_buffer_event_time_stamp() sees a\nzero committing count, triggering WARN_ON_ONCE(!nest).\n\ntracing_event_time_stamp() was added by commit d8279bfc5e959 (\"tracing:\nAdd tracing_event_time_stamp() API\") for exactly this case: if the event\nis the per-CPU trace_buffered_event, it returns the current ring buffer\ntimestamp. But it never gained a caller. Use it in hist_field_timestamp(),\nso that a hist trigger that races onto a buffered event records the\ncurrent time, which is only marginally later than when the event was\nrecorded, instead of warning and recording a bogus timestamp.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"tracing: Fix hist trigger timestamps for buffered events","id":"CVE-2026-99140","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"tracing: Fix crash in print_graph_function_event()","id":"CVE-2026-99141"},"packages":[],"prev":{"headline":"tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)","id":"CVE-2026-99139"},"products":["Linux"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99140/"}