* [CVE-2026-97933][MODERATE 7.0] tracing: Take trace_array reference when opening a tracer options file
@ 2026-09-25 11:37 21% AL-KERNEL
0 siblings, 0 replies; 1+ results
From: AL-KERNEL @ 2026-09-25 11:37 UTC (permalink / raw)
To: kernel-cve
CVE: CVE-2026-97933
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: tracing: Take trace_array reference when opening a tracer options file
Commit: b2fb87d29ffb3a7a9ccc5acf12898ecb80587427
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2fb87d29ffb3a7a9ccc5acf12898ecb80587427
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97933
Analysis date: Fri, 25 Sep 2026 07:37:30 -0400
ActionableScore: 5
ActionableScore lower bound: 4
Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review
Manual review required: YES
Summary:
No one-sentence report phrase was found.
======================================================================
ABOUT THIS REPORT
======================================================================
The original Linux kernel CVE announcement for CVE-2026-97933 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97933
The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.
The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.
Published priority for this report: MODERATE 7.0
Manual review required: YES
A detailed explanation of the methodology and priority rules is included
at the end of this message.
======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================
CVE-2026-97933 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-97933 CHECK WITH IMPACT FROM ORIG NN IMPORTANT Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7';DESCR 'A race between opening a tracer option file and removing the associated trace instance can leave inode i_private pointing to a freed element of the trace_array topts array. The old open path dereferences this element to obtain the trace_array before taking a reference, creating a kernel use after free when instance removal wins the race. The confirmed impact is at least a local denial of service through an invalid access or kernel crash. In a worst case, reuse of the freed descriptor may allow confidentiality or integrity impact because a pointer obtained from freed memory is passed into reference handling, although a reliable escalation primitive is not demonstrated. For the CVSS the PR:L value in the paranoid score represents deployments where tracefs instance management is delegated to a reduced capability administrator, service account, or container root. Normal systems may require PR:H because deleting tracing instances is usually restricted to a full administrator. AC:H applies because successful triggering depends on winning the race between file open and instance removal. The issue is not network reachable and requires local access to the tracing control interface.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 5) SKIP CVE-2026-97933 UNKNOWN SKIP The Fixes patch not applied yet, so unlikely that actual: url YES NO NO unknown MAYBE OOB INIT TRACE RACE UAF KERNEL_PANIC_PLUS_UAF LINUS KPANIC DECREASED_TO_MODERATE7_BASED_ON_FALSEPOSCHECKOFDH - - checked
======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================
ActionableScore=5
ActionableScoreLower=4
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO
1. ActionableScore
* Raw conservative score: 4
* Conservative score: 4
* Raw paranoid score: 5
* Paranoid score: 5
* No floor or cap changed either score.
* Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**::
2. Signal breakdown
Conservative signals:
* +2 Real UAF. `inode->i_private` can retain a pointer to a freed `trace_array->topts` element, which the old open path dereferences as `topt->tr`.
* +1 Reliable kernel crash or strong DoS. Dereferencing the freed descriptor and using the resulting `trace_array` pointer in reference acquisition can produce an invalid access or kernel fault.
* +1 Attacker-influenced active-object lifetime manipulation. An actor allowed to manage tracing instances can repeatedly create, remove, and open option files, directly driving the lifetime transition that creates the stale descriptor.
* Total: 2 + 1 + 1 = 4.
Additional paranoid signal:
* +1 Structured stale-object leverage. The stale descriptor supplies a `trace_array` pointer that is consumed by reference-handling code rather than merely being read for diagnostics. The commit also explicitly recognizes same-address reuse during concurrent instance deletion and creation. This leaves meaningful post-reuse behavior unresolved, although controlled contents are not demonstrated.
* Total: 4 + 1 = 5.
Not awarded:
* No strong exploitation leverage +2. Controlled reclaim, attacker-shaped replacement contents, refcount takeover, callback control, and arbitrary kernel read or write are not established.
* No confidentiality or integrity points. The suggested paranoid CVSS impacts do not independently prove disclosure or unauthorized modification for ActionableScore.
* No local-unprivileged point. Complete access to trace instance creation, removal, and option-file opening below host-admin privilege is not established.
* No privilege penalty. Host-admin-equivalent privilege is also not positively established for every deployment, so uncertainty cannot justify -2.
* No race penalty. The relevant actor can plausibly repeat instance lifecycle operations, and the evidence does not establish a narrow, uncontrollable, one-shot race.
* No remote-reachability point. The interface is local tracefs control.
* No concrete repeated release/refcount point. The patch establishes stale dereference followed by reference acquisition, not an earlier lifetime-ending put followed by a second put on the exact same reference.
* No extra Availability point. The same possible kernel crash is counted only once.
* No rare-subsystem penalty. No evidence establishes that tracing instances are both unusually rare and difficult for an authorized actor to instantiate.
Repeated-release checks:
* First lifetime-ending release: instance removal can free the descriptor and associated array, but this is not the first of two releases on the same surviving reference.
* Exact reference surviving into a second release: not established.
* Second lifetime/refcount decrement: not established. The stale path attempts reference acquisition instead.
* Concrete repeated release/refcount +1: withheld.
* Paranoid repeated-refcount leverage +1: withheld.
* FLOOR 5 based on repeated release: not applicable.
3. Reachability analysis
The complete trigger requires one operation to open a tracer option file while another removes the trace instance owning its `topts` descriptor. An actor able to create and remove tracefs instances can plausibly repeat both sides of the race and influence allocator reuse by creating replacement instances.
Tracefs is commonly restricted to administrators, but the supplied evidence does not identify the exact permission checks or prove that init-user-namespace `CAP_SYS_ADMIN` is mandatory. Conversely, it does not prove that an ordinary user, container root, or namespace-scoped capability can perform the complete sequence. Therefore both host-admin requirement and namespace-scoped reachability remain unknown.
No prior hardware, boot-mode, device, or network prerequisite is shown. Tracefs availability and sufficient filesystem permissions are required. The race is local and not packet-triggerable.
4. Primitive and severity interpretation
The exact primitive is a real UAF of a tracer-option descriptor. The stale object is an active structured object because its `tr` field selects a `trace_array` that is passed into reference-handling logic. This is not fixed asynchronous storage and is not limited to a passive diagnostic read.
The vulnerable use occurs in the normal option-file open path, not solely in a destructor or cleanup path. Instance removal performs the freeing operation, while a concurrent open dereferences the stale descriptor before obtaining the reference intended to stabilize the parent object.
There is no concrete double release. The stale operation attempts to obtain a reference through data read from freed storage, which is potentially more consequential than an immediate poisoned-pointer fault but does not establish controlled refcount takeover.
The demonstrated consequence is kernel invalid access or crash. A stronger consequence is technically plausible because reclaimed descriptor contents can influence which pointer enters reference handling, but attacker-controlled reclaim, arbitrary read or write, disclosure, and privilege escalation are not demonstrated.
This is CLASS_B rather than CLASS_A. ImportantCandidate is YES because it is an active-path kernel UAF with repeatable lifetime manipulation and unresolved structured-pointer use. AutoDowngradeAllowed is NO because automatically treating it as an ordinary crash-only race could discard meaningful unresolved leverage from reclaimed descriptor state. The likely operational severity is Actionable Moderate pending exploitation analysis, with Important classification possible but not established.
5. One-sentence report phrase
A local race between tracer option opening and trace instance removal can dereference a freed option descriptor and feed a stale trace_array pointer into reference handling, causing at least a kernel crash while leaving post-reuse exploitation leverage unresolved.
6. Manual review recommendation
MANUAL CHECK REQUIRED
The patch establishes an active-object kernel UAF outside a cleanup-only path, and the stale field influences reference handling after an attacker-repeatable instance lifetime transition, but the available evidence does not resolve reclaim control or non-crash impact.
7. Call-site confidence
Call-site confidence: medium
======================================================================
UPSTREAM PATCH SUMMARY
======================================================================
Patch: tracing: Take trace_array reference when opening a tracer options file
Commit: b2fb87d29ffb3a7a9ccc5acf12898ecb80587427
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2fb87d29ffb3a7a9ccc5acf12898ecb80587427
Commit description:
When a tracer option file is opened, it is passed a descriptor that points
to an element on the trace_array's topts array. This element has
information to find the trace array and other information. It uses this
element to take a reference of the trace_array so that the trace_array
does not get removed while this file is opened.
Unfortunately, there's a race condition where the element itself could be
freed by the removal of the instance the trace_array represents causing a
use-after-free as this element that is used to find the trace_array to
increment its reference counter is also freed when the instance is
removed.
To solve this, add a trace_array_tracer_options_get() helper function that
will take the address of the element that is passed to the open function
by the inode->i_private pointer and search all the trace_arrays under a
lock to find the one that the element's address is in the range of the
trace_arrays topts array elements. When a match happens, that trace_array's
reference would be increased.
Note, there's a race where if an admin was deleting and creating trace
instances at the same time and the memory of the old trace_array's array
matched the memory of the new trace_array that it could in theory open the
option from the wrong trace array. But we do not care because it would be
stupid to perform that kind of action. As long as the only thing that can
happen is that the option from the wrong trace array is used and doesn't
crash the kernel it will only make the user confused. But if they are
doing something stupid like this, they are already confused, so no harm
done.
Cc: [email protected]
Link: https://patch.msgid.link/20260910221209.62dad8d3@robin
Fixes: 7e2cfbd ("tracing: Have option files inc the trace array ref count")
Reported-by: [email protected]
Closes: https://lore.kernel.org/linux-trace-kernel/[email protected]/
Signed-off-by: Steven Rostedt <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Changed files:
kernel/20260902121918.5a9e9d1b
kernel/trace/trace.c
kernel/trace/trace.h
Diff excerpt:
Not included in this email. See the upstream URL for the full patch.
Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2fb87d29ffb3a7a9ccc5acf12898ecb80587427
======================================================================
DETAILED REPORT METHODOLOGY
======================================================================
The original Linux kernel CVE announcement for CVE-2026-97933 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97933
The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.
The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.
The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.
Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:
Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The Best / paranoid CVSS score: 7
The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.
CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.
A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.
Conservative ActionableScore: 4
Paranoid ActionableScore: 5
The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.
For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:
ActionableScore below 5 -> MODERATE REGULAR
ActionableScore 5 or more -> MODERATE 7.0
The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.
There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).
KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.
AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0
These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).
Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is [email protected] (and both
send reply to CVE record itself too and see "reply" button below for howto reply).
^ permalink raw reply [relevance 21%]
Results 1-1 of 1 | reverse | sort options + mbox downloads above
-- links below jump to the message on this page --
2026-09-25 11:37 21% [CVE-2026-97933][MODERATE 7.0] tracing: Take trace_array reference when opening a tracer options file AL-KERNEL
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox