From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-97933][MODERATE 7.0] tracing: Take trace_array reference when opening a tracer options file Date: Fri, 25 Sep 2026 07:37:30 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-97933 X-AL-KERNEL-Priority: MODERATE 7.0 X-AL-KERNEL-Severity: MODERATE 7.0 X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: YES X-AL-KERNEL-ActionableScore: 5 X-AL-KERNEL-ActionableScore-Lower: 4 X-AL-KERNEL-Commit: b2fb87d29ffb3a7a9ccc5acf12898ecb80587427 List-Id: CVE: CVE-2026-97933 Priority: MODERATE 7.0 AL-KERNEL base severity: MODERATE KPANIC flag: YES Patch: tracing: Take trace_array reference when opening a tracer options file Commit: b2fb87d29ffb3a7a9ccc5acf12898ecb80587427 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2fb87d29ffb3a7a9ccc5acf12898ecb80587427 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97933 Analysis date: Fri, 25 Sep 2026 07:37:30 -0400 ActionableScore: 5 ActionableScore lower bound: 4 Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review Manual review required: YES Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97933 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97933 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE 7.0 Manual review required: YES A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-97933 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-97933 CHECK WITH IMPACT FROM ORIG NN IMPORTANT Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7';DESCR 'A race between opening a tracer option file and removing the associated trace instance can leave inode i_private pointing to a freed element of the trace_array topts array. The old open path dereferences this element to obtain the trace_array before taking a reference, creating a kernel use after free when instance removal wins the race. The confirmed impact is at least a local denial of service through an invalid access or kernel crash. In a worst case, reuse of the freed descriptor may allow confidentiality or integrity impact because a pointer obtained from freed memory is passed into reference handling, although a reliable escalation primitive is not demonstrated. For the CVSS the PR:L value in the paranoid score represents deployments where tracefs instance management is delegated to a reduced capability administrator, service account, or container root. Normal systems may require PR:H because deleting tracing instances is usually restricted to a full administrator. AC:H applies because successful triggering depends on winning the race between file open and instance removal. The issue is not network reachable and requires local access to the tracing control interface.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 5) SKIP CVE-2026-97933 UNKNOWN SKIP The Fixes patch not applied yet, so unlikely that actual: url YES NO NO unknown MAYBE OOB INIT TRACE RACE UAF KERNEL_PANIC_PLUS_UAF LINUS KPANIC DECREASED_TO_MODERATE7_BASED_ON_FALSEPOSCHECKOFDH - - checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=5 ActionableScoreLower=4 PrimitiveClass=CLASS_B RealUAF=YES HostAdminRequired=UNKNOWN NamespaceScopedPrivilege=UNKNOWN ImportantCandidate=YES ManualReview=REQUIRED AutoDowngradeAllowed=NO 1. ActionableScore * Raw conservative score: 4 * Conservative score: 4 * Raw paranoid score: 5 * Paranoid score: 5 * No floor or cap changed either score. * Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**:: 2. Signal breakdown Conservative signals: * +2 Real UAF. `inode->i_private` can retain a pointer to a freed `trace_array->topts` element, which the old open path dereferences as `topt->tr`. * +1 Reliable kernel crash or strong DoS. Dereferencing the freed descriptor and using the resulting `trace_array` pointer in reference acquisition can produce an invalid access or kernel fault. * +1 Attacker-influenced active-object lifetime manipulation. An actor allowed to manage tracing instances can repeatedly create, remove, and open option files, directly driving the lifetime transition that creates the stale descriptor. * Total: 2 + 1 + 1 = 4. Additional paranoid signal: * +1 Structured stale-object leverage. The stale descriptor supplies a `trace_array` pointer that is consumed by reference-handling code rather than merely being read for diagnostics. The commit also explicitly recognizes same-address reuse during concurrent instance deletion and creation. This leaves meaningful post-reuse behavior unresolved, although controlled contents are not demonstrated. * Total: 4 + 1 = 5. Not awarded: * No strong exploitation leverage +2. Controlled reclaim, attacker-shaped replacement contents, refcount takeover, callback control, and arbitrary kernel read or write are not established. * No confidentiality or integrity points. The suggested paranoid CVSS impacts do not independently prove disclosure or unauthorized modification for ActionableScore. * No local-unprivileged point. Complete access to trace instance creation, removal, and option-file opening below host-admin privilege is not established. * No privilege penalty. Host-admin-equivalent privilege is also not positively established for every deployment, so uncertainty cannot justify -2. * No race penalty. The relevant actor can plausibly repeat instance lifecycle operations, and the evidence does not establish a narrow, uncontrollable, one-shot race. * No remote-reachability point. The interface is local tracefs control. * No concrete repeated release/refcount point. The patch establishes stale dereference followed by reference acquisition, not an earlier lifetime-ending put followed by a second put on the exact same reference. * No extra Availability point. The same possible kernel crash is counted only once. * No rare-subsystem penalty. No evidence establishes that tracing instances are both unusually rare and difficult for an authorized actor to instantiate. Repeated-release checks: * First lifetime-ending release: instance removal can free the descriptor and associated array, but this is not the first of two releases on the same surviving reference. * Exact reference surviving into a second release: not established. * Second lifetime/refcount decrement: not established. The stale path attempts reference acquisition instead. * Concrete repeated release/refcount +1: withheld. * Paranoid repeated-refcount leverage +1: withheld. * FLOOR 5 based on repeated release: not applicable. 3. Reachability analysis The complete trigger requires one operation to open a tracer option file while another removes the trace instance owning its `topts` descriptor. An actor able to create and remove tracefs instances can plausibly repeat both sides of the race and influence allocator reuse by creating replacement instances. Tracefs is commonly restricted to administrators, but the supplied evidence does not identify the exact permission checks or prove that init-user-namespace `CAP_SYS_ADMIN` is mandatory. Conversely, it does not prove that an ordinary user, container root, or namespace-scoped capability can perform the complete sequence. Therefore both host-admin requirement and namespace-scoped reachability remain unknown. No prior hardware, boot-mode, device, or network prerequisite is shown. Tracefs availability and sufficient filesystem permissions are required. The race is local and not packet-triggerable. 4. Primitive and severity interpretation The exact primitive is a real UAF of a tracer-option descriptor. The stale object is an active structured object because its `tr` field selects a `trace_array` that is passed into reference-handling logic. This is not fixed asynchronous storage and is not limited to a passive diagnostic read. The vulnerable use occurs in the normal option-file open path, not solely in a destructor or cleanup path. Instance removal performs the freeing operation, while a concurrent open dereferences the stale descriptor before obtaining the reference intended to stabilize the parent object. There is no concrete double release. The stale operation attempts to obtain a reference through data read from freed storage, which is potentially more consequential than an immediate poisoned-pointer fault but does not establish controlled refcount takeover. The demonstrated consequence is kernel invalid access or crash. A stronger consequence is technically plausible because reclaimed descriptor contents can influence which pointer enters reference handling, but attacker-controlled reclaim, arbitrary read or write, disclosure, and privilege escalation are not demonstrated. This is CLASS_B rather than CLASS_A. ImportantCandidate is YES because it is an active-path kernel UAF with repeatable lifetime manipulation and unresolved structured-pointer use. AutoDowngradeAllowed is NO because automatically treating it as an ordinary crash-only race could discard meaningful unresolved leverage from reclaimed descriptor state. The likely operational severity is Actionable Moderate pending exploitation analysis, with Important classification possible but not established. 5. One-sentence report phrase A local race between tracer option opening and trace instance removal can dereference a freed option descriptor and feed a stale trace_array pointer into reference handling, causing at least a kernel crash while leaving post-reuse exploitation leverage unresolved. 6. Manual review recommendation MANUAL CHECK REQUIRED The patch establishes an active-object kernel UAF outside a cleanup-only path, and the stale field influences reference handling after an attacker-repeatable instance lifetime transition, but the available evidence does not resolve reclaim control or non-crash impact. 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: tracing: Take trace_array reference when opening a tracer options file Commit: b2fb87d29ffb3a7a9ccc5acf12898ecb80587427 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2fb87d29ffb3a7a9ccc5acf12898ecb80587427 Commit description: When a tracer option file is opened, it is passed a descriptor that points to an element on the trace_array's topts array. This element has information to find the trace array and other information. It uses this element to take a reference of the trace_array so that the trace_array does not get removed while this file is opened. Unfortunately, there's a race condition where the element itself could be freed by the removal of the instance the trace_array represents causing a use-after-free as this element that is used to find the trace_array to increment its reference counter is also freed when the instance is removed. To solve this, add a trace_array_tracer_options_get() helper function that will take the address of the element that is passed to the open function by the inode->i_private pointer and search all the trace_arrays under a lock to find the one that the element's address is in the range of the trace_arrays topts array elements. When a match happens, that trace_array's reference would be increased. Note, there's a race where if an admin was deleting and creating trace instances at the same time and the memory of the old trace_array's array matched the memory of the new trace_array that it could in theory open the option from the wrong trace array. But we do not care because it would be stupid to perform that kind of action. As long as the only thing that can happen is that the option from the wrong trace array is used and doesn't crash the kernel it will only make the user confused. But if they are doing something stupid like this, they are already confused, so no harm done. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260910221209.62dad8d3@robin Fixes: 7e2cfbd ("tracing: Have option files inc the trace array ref count") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@gandalf.local.home/ Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Changed files: kernel/20260902121918.5a9e9d1b kernel/trace/trace.c kernel/trace/trace.h Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b2fb87d29ffb3a7a9ccc5acf12898ecb80587427 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97933 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97933 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H The Best / paranoid CVSS score: 7 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: 4 Paranoid ActionableScore: 5 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: YES Published priority for this report (same as in Subject): MODERATE 7.0 These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).