CVE-2026-99141

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags of the newly selected tracer with: tr->current_trace_flags = t->flags ? : t->tracer->flags; If the new tracer defines neither static flags nor default flags, like hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy for it, and both operands are NULL, so tr->current_trace_flags ends up being NULL as well. The ring buffer is not cleared when switching tracers: it is reset inside tracer_init(), after current_trace_flags was already assigned. If the buffer still holds function_graph entries of the previous tracer, printing one of them dereferences the NULL pointer. This was hit by cat trace during an ftrace stress test: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode RIP: 0010:print_graph_function_event+0xe/0x20 Call Trace: s_show+0x4d/0x110 seq_read_iter+0x2d4/0x490 seq_read+0x130/0x170 vfs_read+0xb5/0x370 ksys_read+0x6d/0xe0 do_syscall_64+0xbc/0x450 The snapshot buffer is not reset at all, so this can be reproduced without a race: echo function_graph > /sys/kernel/tracing/current_tracer echo 1 > /sys/kernel/tracing/snapshot echo hwlat > /sys/kernel/tracing/current_tracer cat /sys/kernel/tracing/snapshot Rather than teaching every user of tr->current_trace_flags about this corner case, make sure it is never NULL: when the newly selected tracer has no flags at all, tracing_set_tracer() falls back to a static empty no_tracer_flags. run_tracer_selftest() can hit the same case, so the same fallback is added there too. The existing users already handle opts == NULL, so these tracers keep behaving as before.

• https://git.kernel.org/stable/c/3cc117514d69067a94d6c7479730dce41e678f50
• https://git.kernel.org/stable/c/b1547c6ba93b8863010aa324cd20c441f886f23e

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-99136In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-99137In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99138In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99139In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9914Insufficient validation of untrusted input in ANGLE in Googl…8.3
• CVE-2026-99140In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99142In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-99143In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-99144In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99145In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99146In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99147In the Linux kernel, the following vulnerability has been re…