ftrace: Initialize modname and offset in print_rec()
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: Avoid reading available_filter_functions while modules are being loaded or unloaded, since that timing is the trigger described in the advisory. Limiting that read until a fixed kernel is installed reduces the chance of a crash.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 25/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's ftrace subsystem, specifically the function that lists available traced functions (available_filter_functions), is affected. A flaw can cause a crash (general protection fault) when this file is read while kernel modules are being loaded or unloaded, potentially leading to a system denial of service.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in print_rec() print_rec() leaves 'modname' and 'offset' uninitialized and kallsyms_lookup() only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(). Oops: general protection fault RIP: 0010:string+0x48/0xe0 Call Trace: vsnprintf+0x1f5/0x650 seq_printf+0x8e/0xb0 print_rec+0x6c/0xc0 t_show+0x4c/0x440 seq_read_iter+0x119/0x480 This can be triggered by reading available_filter_functions while a module is being loaded or unloaded. Initialize both variables so a failed lookup skips the module name.
What to do
Workaround: Avoid reading available_filter_functions while modules are being loaded or unloaded, since that timing is the trigger described in the advisory. Limiting that read until a fixed kernel is installed reduces the chance of a crash.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
5.19
Evidence 6
- Link
- Link
- Link
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-99219
What does this mean?
Reading the available_filter_functions file while a kernel module is being loaded or unloaded can trigger a kernel general protection fault, which crashes the system. The crash comes from print_rec() dereferencing a garbage pointer because its modname and offset values were never initialized.Source: git.kernel.org
Am I affected, and how do I check?
The advisory names the Linux kernel without listing specific version ranges. To check a system, run uname -r to see the running kernel version and compare it with the fixed versions in your distribution's advisory. The bug needs a read of available_filter_functions during a module load or unload, so check whether that file is read on the system.Source: git.kernel.org
What should I do about it?
The available facts do not name a fixed kernel version, so check your distribution's or the upstream kernel's advisory for the patched release. Install the updated kernel from your vendor once it is published.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
Avoid reading available_filter_functions while modules are being loaded or unloaded, since that timing is the trigger described in the advisory. Limiting that read until a fixed kernel is installed reduces the chance of a crash.Source: git.kernel.org