---
id: CVE-2026-99141
title: 'tracing: Fix crash in print_graph_function_event()'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix crash in print_graph_function_event()\n\ntracing_set_tracer() assigns the flags of the newly selected tracer\nwith:\n\n\ttr->current_trace_flags = t->flags ? : t…"
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e29aa918a928408c3e64b0d1025e4eb9f6fc549e <
    b1547c6ba93b8863010aa324cd20c441f886f23e
  - >-
    Linux >= e29aa918a928408c3e64b0d1025e4eb9f6fc549e <
    3cc117514d69067a94d6c7479730dce41e678f50
  - Linux 6.19
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:34:52.091Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99141'
references:
  - url: 'https://git.kernel.org/stable/c/b1547c6ba93b8863010aa324cd20c441f886f23e'
  - url: 'https://git.kernel.org/stable/c/3cc117514d69067a94d6c7479730dce41e678f50'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.425Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix crash in print_graph_function_event()

tracing_set_tracer() assigns the flags of the newly selected tracer
with:

	tr->current_trace_flags = t->flags ? : t->tracer->flags;

If the new tracer defines neither static flags nor default flags, like
hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy
for it, and both operands are NULL, so tr->current_trace_flags ends up
being NULL as well.

The ring buffer is not cleared when switching tracers: it is reset
inside tracer_init(), after current_trace_flags was already assigned.
If the buffer still holds function_graph entries of the previous
tracer, printing one of them dereferences the NULL pointer. This was
hit by cat trace during an ftrace stress test:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor read access in kernel mode
  RIP: 0010:print_graph_function_event+0xe/0x20
  Call Trace:
   s_show+0x4d/0x110
   seq_read_iter+0x2d4/0x490
   seq_read+0x130/0x170
   vfs_read+0xb5/0x370
   ksys_read+0x6d/0xe0
   do_syscall_64+0xbc/0x450

The snapshot buffer is not reset at all, so this can be reproduced
without a race:

  echo function_graph > /sys/kernel/tracing/current_tracer
  echo 1 > /sys/kernel/tracing/snapshot
  echo hwlat > /sys/kernel/tracing/current_tracer
  cat /sys/kernel/tracing/snapshot

Rather than teaching every user of tr->current_trace_flags about this
corner case, make sure it is never NULL: when the newly selected
tracer has no flags at all, tracing_set_tracer() falls back to a
static empty no_tracer_flags. run_tracer_selftest() can hit the same
case, so the same fallback is added there too. The existing users
already handle opts == NULL, so these tracers keep behaving as before.

## Affected

- `Linux >= e29aa918a928408c3e64b0d1025e4eb9f6fc549e < b1547c6ba93b8863010aa324cd20c441f886f23e`
- `Linux >= e29aa918a928408c3e64b0d1025e4eb9f6fc549e < 3cc117514d69067a94d6c7479730dce41e678f50`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.