CVE-2026-99141 tracing: Fix crash in print_graph_function_event()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99141?
CVE-2026-99141 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix crash in print_graph_function_event()
tracing_set_tracer() assigns the flags of the newly selected tracer with:
tr->current_trace_flags = t->flags ? : t->tracer->flags;
If the new tracer defines neither static flags nor default flags, like hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy for it, and both operands are NULL, so tr->current_trace_flags ends up being NULL as well.
The ring buffer is not cleared when switching tracers: it is reset inside tracer_init(), after current_trace_flags was already assigned. If the buffer still holds function_graph entries of the previous tracer, printing one of them dereferences the NULL pointer. This was hit by cat trace during an ftrace stress test:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode RIP: 0010:print_graph_function_event+0xe/0x20 Call Trace: s_show+0x4d/0x110 seq_read_iter+0x2d4/0x490 seq_read+0x130/0x170 vfs_read+0xb5/0x370 ksys_read+0x6d/0xe0 do_syscall_64+0xbc/0x450
The snapshot buffer is not reset at all, so this can be reproduced without a race:
echo function_graph > /sys/kernel/tracing/current_tracer echo 1 > /sys/kernel/tracing/snapshot echo hwlat > /sys/kernel/tracing/current_tracer cat /sys/kernel/tracing/snapshot
Rather than teaching every user of tr->current_trace_flags about this corner case, make sure it is never NULL: when the newly selected tracer has no flags at all, tracing_set_tracer() falls back to a static empty no_tracer_flags. run_tracer_selftest() can hit the same case, so the same fallback is added there too. The existing users already handle opts == NULL, so these tracers keep behaving as before.
Which versions are affected by CVE-2026-99141?
How do I fix CVE-2026-99141?
Upgrade to a fixed version.
Is CVE-2026-99141 being exploited?
There is no known exploitation of CVE-2026-99141 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-99141, GHSA-jfp7-c7j3-v9pj, UBUNTU-CVE-2026-99141.