NULL pointer dereference in Linux kernel - CVE-2026-99159
Published: October 29, 2026
Vulnerability identifier: #VU158422
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99159
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service and loss of trace data from the previous boot.
The vulnerability exists due to an incorrect sub-buffer base calculation in rb_meta_subbuf_idx() when calculating indices for a persistent ring buffer. A local user can map trace_pipe_raw from userspace to trigger a NULL pointer dereference in __rb_map_vma(), potentially crashing the kernel. Incorrect indices stored in the metadata can also cause the previous boot's trace to be discarded on the next boot.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99159
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2