---
id: CVE-2026-99237
title: 'tracing: Hold trace_types_lock when resetting last boot data from readers'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Hold trace_types_lock when resetting last boot data from readers

  update_last_data_if_empty() is called from tracing_open() with O_TRUNC,
  tracing_read_pipe() a…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea <
    92b69f6db640dadc0851762ee2e12db99f083cad
  - >-
    Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea <
    d6d991afe775ab7fcf89523a2502b7ca3be56ffd
  - >-
    Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea <
    1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa
  - >-
    Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea <
    5a6bd62f09147b49b31fd19d4eba122cb5f941a1
  - Linux 6.16
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:13:04.997Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99237'
references:
  - url: 'https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad'
  - url: 'https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd'
  - url: 'https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa'
  - url: 'https://git.kernel.org/stable/c/5a6bd62f09147b49b31fd19d4eba122cb5f941a1'
tags:
  - cve.org
epss: 0.0012
epssPercentile: 0.01846
ingestedAt: '2026-11-05T20:33:06.389Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Hold trace_types_lock when resetting last boot data from readers

update_last_data_if_empty() is called from tracing_open() with O_TRUNC,
tracing_read_pipe() and tracing_buffers_read() without trace_types_lock.
Two readers can both pass the LAST_BOOT test and free module_delta
twice, and a module notifier can update module_delta while it is being
freed.

Take trace_types_lock in those paths and keep the callers that already
hold it on an unlocked variant.

## Affected

- `Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea < 92b69f6db640dadc0851762ee2e12db99f083cad`
- `Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea < d6d991afe775ab7fcf89523a2502b7ca3be56ffd`
- `Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea < 1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa`
- `Linux >= 32dc0042528d385d83bf458e4cf3a49c5110afea < 5a6bd62f09147b49b31fd19d4eba122cb5f941a1`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.