CVE-2026-31541

{"id": "CVE-2026-31541", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "lessThan": "75668e58244e63ec3785098a02e1cdcff14a6c2e", "versionType": "git"}, {"status": "affected", "version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "lessThan": "cc267e4b4302247dc67ef937a9ac587a696a43c1", "versionType": "git"}, {"status": "affected", "version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "lessThan": "07183aac4a6828e474f00b37c9d795d0d99e18a7", "versionType": "git"}], "programFiles": ["kernel/trace/trace.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/trace/trace.c"], "defaultStatus": "affected"}]}], "published": "2026-04-24T15:16:28.117", "references": [{"url": "https://git.kernel.org/stable/c/07183aac4a6828e474f00b37c9d795d0d99e18a7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/75668e58244e63ec3785098a02e1cdcff14a6c2e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cc267e4b4302247dc67ef937a9ac587a696a43c1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix trace_marker copy link list updates\n\nWhen the \"copy_trace_marker\" option is enabled for an instance, anything\nwritten into /sys/kernel/tracing/trace_marker is also copied into that\ninstances buffer. When the option is set, that instance's trace_array\ndescriptor is added to the marker_copies link list. This list is protected\nby RCU, as all iterations uses an RCU protected list traversal.\n\nWhen the instance is deleted, all the flags that were enabled are cleared.\nThis also clears the copy_trace_marker flag and removes the trace_array\ndescriptor from the list.\n\nThe issue is after the flags are called, a direct call to\nupdate_marker_trace() is performed to clear the flag. This function\nreturns true if the state of the flag changed and false otherwise. If it\nreturns true here, synchronize_rcu() is called to make sure all readers\nsee that its removed from the list.\n\nBut since the flag was already cleared, the state does not change and the\nsynchronization is never called, leaving a possible UAF bug.\n\nMove the clearing of all flags below the updating of the copy_trace_marker\noption which then makes sure the synchronization is performed.\n\nAlso use the flag for checking the state in update_marker_trace() instead\nof looking at if the list is empty."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntracing: Soluci\u00f3n a las actualizaciones de la lista enlazada de copia de trace_marker\n\nCuando la opci\u00f3n \u2019copy_trace_marker\u2019 est\u00e1 habilitada para una instancia, cualquier cosa escrita en /sys/kernel/tracing/trace_marker tambi\u00e9n se copia en el b\u00fafer de esa instancia. Cuando la opci\u00f3n est\u00e1 configurada, el descriptor trace_array de esa instancia se a\u00f1ade a la lista enlazada marker_copies. Esta lista est\u00e1 protegida por RCU, ya que todas las iteraciones utilizan un recorrido de lista protegido por RCU.\n\nCuando la instancia es eliminada, todas las banderas que estaban habilitadas se borran. Esto tambi\u00e9n borra la bandera copy_trace_marker y elimina el descriptor trace_array de la lista.\n\nEl problema es que despu\u00e9s de que se llaman las banderas, se realiza una llamada directa a update_marker_trace() para borrar la bandera. Esta funci\u00f3n devuelve verdadero si el estado de la bandera cambi\u00f3 y falso en caso contrario. Si devuelve verdadero aqu\u00ed, se llama a synchronize_rcu() para asegurarse de que todos los lectores vean que se ha eliminado de la lista.\n\nPero como la bandera ya estaba borrada, el estado no cambia y la sincronizaci\u00f3n nunca se llama, dejando un posible error UAF.\n\nMover el borrado de todas las banderas debajo de la actualizaci\u00f3n de la opci\u00f3n copy_trace_marker, lo que luego asegura que se realice la sincronizaci\u00f3n.\n\nTambi\u00e9n usar la bandera para verificar el estado en update_marker_trace() en lugar de mirar si la lista est\u00e1 vac\u00eda."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C570CE1-BC61-4BE6-9393-FD0CA8637367", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}