# CVE-2026-99238: Linux kernel race condition in tracing module updates

Source: https://junglewise.ai/threats/cve-2026-99238-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-99238 · Severity: high · CVSS 7.8 · Published 2026-11-02

The Linux kernel's tracing system fails to properly synchronize access when modules are loaded or unloaded while trace instances are being removed, allowing a module operation to read from freed memory. An attacker with local access could trigger this race condition to cause a kernel crash or potentially execute arbitrary code.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-99238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99238 being exploited in the wild.

**How severe is CVE-2026-99238?** High severity, with a CVSS score of 7.8, published 2 November 2026.

**Which products and versions are affected?** Linux Kernel 5.0 through 6.19 (affected versions vary by stable branch; patched across multiple stable trees).

**Is there a fix for CVE-2026-99238?** Yes: fixed in Fixed via commit 66877a312ae3c2c3d849e82e882f642ffd4ec3e2 applied across Linux stable trees (5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.10.y, 6.11.y and others). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-99238 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99238?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed via commit 66877a312ae3c2c3d849e82e882f642ffd4ec3e2 applied across Linux stable trees (5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.10.y, 6.11.y and others)

## Technical details

A use-after-free race condition exists in trace_module_record() in kernel/trace/trace.c: the function walks the ftrace_trace_arrays list from the module notifier without holding trace_types_lock, while concurrent rmdir operations remove and free trace_array entries under that lock. An attacker with local privileges can trigger module load/unload and instance deletion simultaneously to cause the function to dereference freed memory.

## Affected products

- Linux Linux kernel 5.0 through 6.19 (affected versions vary by stable branch; patched across multiple stable trees)

## Timeline

- 2026-11-02: disclosed
- 2026-10-30: patched

## References

- [https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e](https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e)
- [https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a](https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)