SB20261029143 - NULL pointer dereference in Linux kernel trace

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99159)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and loss of trace data from the previous boot.

The vulnerability exists due to an incorrect sub-buffer base calculation in rb_meta_subbuf_idx() when calculating indices for a persistent ring buffer. A local user can map trace_pipe_raw from userspace to trigger a NULL pointer dereference in __rb_map_vma(), potentially crashing the kernel. Incorrect indices stored in the metadata can also cause the previous boot's trace to be discarded on the next boot.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/25132363c723afc39aace8b098f547ab4a0ea759
• https://git.kernel.org/stable/c/2f1248b728b56d583ea454fedf239550c49f7b18
• https://git.kernel.org/stable/c/7469b3585ef5f65840d467d2caa811a9098c84b9