---
id: CVE-2026-99232
title: 'tracing/syscalls: Use copy_from_user for the faultable syscall buffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing/syscalls: Use copy_from_user for the faultable syscall buffer

  syscall_copy_user_array() copies the buffer argument of faultable
  syscalls (write, pwrite64, ...)…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= baa031b7bd2ce7502339174a42974321859ecd6a <
    e33e2718c62a602001ab549642a1aed0be797105
  - >-
    Linux >= baa031b7bd2ce7502339174a42974321859ecd6a <
    041d1a568a11a7ed7415ef1408d0c65041c1ad69
  - >-
    Linux >= baa031b7bd2ce7502339174a42974321859ecd6a <
    097fd0050089df17b032f2b852b9b65e548e342a
  - Linux 6.19
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:13:01.998Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99232'
references:
  - url: 'https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105'
  - url: 'https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69'
  - url: 'https://git.kernel.org/stable/c/097fd0050089df17b032f2b852b9b65e548e342a'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04656
ingestedAt: '2026-11-05T20:33:06.388Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing/syscalls: Use copy_from_user for the faultable syscall buffer

syscall_copy_user_array() copies the buffer argument of faultable
syscalls (write, pwrite64, ...) with __copy_from_user(), which skips
access_ok(). Use copy_from_user() instead so a non-user address is
rejected and the entry is recorded as faulted.

It could be a security concern for machines that trust perf a bit too
much.

## Affected

- `Linux >= baa031b7bd2ce7502339174a42974321859ecd6a < e33e2718c62a602001ab549642a1aed0be797105`
- `Linux >= baa031b7bd2ce7502339174a42974321859ecd6a < 041d1a568a11a7ed7415ef1408d0c65041c1ad69`
- `Linux >= baa031b7bd2ce7502339174a42974321859ecd6a < 097fd0050089df17b032f2b852b9b65e548e342a`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.