CVE-2026-99232

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99232", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.402Z", "datePublished": "2026-11-02T16:06:39.212Z", "dateUpdated": "2026-11-03T19:13:01.998Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-03T19:13:01.998Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_syscalls.c"], "versions": [{"version": "baa031b7bd2ce7502339174a42974321859ecd6a", "lessThan": "e33e2718c62a602001ab549642a1aed0be797105", "status": "affected", "versionType": "git"}, {"version": "baa031b7bd2ce7502339174a42974321859ecd6a", "lessThan": "041d1a568a11a7ed7415ef1408d0c65041c1ad69", "status": "affected", "versionType": "git"}, {"version": "baa031b7bd2ce7502339174a42974321859ecd6a", "lessThan": "097fd0050089df17b032f2b852b9b65e548e342a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_syscalls.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.1", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105"}, {"url": "https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69"}, {"url": "https://git.kernel.org/stable/c/097fd0050089df17b032f2b852b9b65e548e342a"}], "title": "tracing/syscalls: Use copy_from_user for the faultable syscall buffer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace_syscalls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e33e2718c62a602001ab549642a1aed0be797105", "status": "affected", "version": "baa031b7bd2ce7502339174a42974321859ecd6a", "versionType": "git"}, {"lessThan": "041d1a568a11a7ed7415ef1408d0c65041c1ad69", "status": "affected", "version": "baa031b7bd2ce7502339174a42974321859ecd6a", "versionType": "git"}, {"lessThan": "097fd0050089df17b032f2b852b9b65e548e342a", "status": "affected", "version": "baa031b7bd2ce7502339174a42974321859ecd6a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace_syscalls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\n\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\n\nIt could be a security concern for machines that trust perf a bit too\nmuch."}], "id": "CVE-2026-99232", "lastModified": "2026-11-03T20:18:29.153", "metrics": {}, "published": "2026-11-02T16:17:48.247", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/097fd0050089df17b032f2b852b9b65e548e342a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Information disclosure via improper memory address validation in syscall tracing", "id": "2565264", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565264"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-822", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntracing/syscalls: Use copy_from_user for the faultable syscall buffer\nsyscall_copy_user_array() copies the buffer argument of faultable\nsyscalls (write, pwrite64, ...) with __copy_from_user(), which skips\naccess_ok(). Use copy_from_user() instead so a non-user address is\nrejected and the entry is recorded as faulted.\nIt could be a security concern for machines that trust perf a bit too\nmuch.", "A flaw was found in the Linux kernel. A local attacker can trigger this issue by invoking faultable system calls with non-user memory addresses while tracing is active. Because the kernel fails to verify that the source address resides in user space before copying data into trace buffers, this flaw may lead to information disclosure of sensitive kernel memory."], "name": "CVE-2026-99232", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99232\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99232\nhttps://git.kernel.org/stable/c/041d1a568a11a7ed7415ef1408d0c65041c1ad69\nhttps://git.kernel.org/stable/c/e33e2718c62a602001ab549642a1aed0be797105"], "statement": "This vulnerability is rated as Moderate severity because exploitation is confined to local environments and depends on active syscall tracing, which is disabled by default on standard Red Hat Enterprise Linux installations. An unprivileged local user cannot trigger trace event capture unless an administrator or privileged monitoring process explicitly enables tracing of faultable system calls. While unauthorized disclosure of kernel memory could expose sensitive system details, the defect does not allow arbitrary privilege escalation or system disruption directly.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa031b7bd2ce7502339174a42974321859ecd6a,e33e2718c62a602001ab549642a1aed0be797105)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa031b7bd2ce7502339174a42974321859ecd6a,041d1a568a11a7ed7415ef1408d0c65041c1ad69)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.1,7.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa031b7bd2ce7502339174a42974321859ecd6a,e33e2718c62a602001ab549642a1aed0be797105)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa031b7bd2ce7502339174a42974321859ecd6a,041d1a568a11a7ed7415ef1408d0c65041c1ad69)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.1,7.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T18:45:13.292668+00:00", "updated": "2026-11-05T05:30:18.306745+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}