Linux Kernel CVE-2026-99237

Requires local access to the kernel trace filesystem (e.g. /sys/kernel/tracing), which is root/CAP_SYS_ADMIN-restricted by default, and the target must be using the persistent boot-mapped 'last boot' ring buffer feature so that update_last_data_if_empty() and the LAST_BOOT path are reachable. The attacker must drive at least two concurrent readers (tracing_open with O_TRUNC, tracing_read_pipe, or tracing_buffers_read) to both pass the LAST_BOOT check and hit the double-free of module_delta. Limiting factors: local-only (not remotely reachable), dependence on this non-default persistent-tracing configuration, the need to win a narrow race window, and default tracefs permissions that restrict who can open these files.

This is a local kernel-memory-corruption race in the Linux tracing subsystem, not a remotely reachable flaw. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) scores it High with full CIA impact, consistent with a kernel double-free that can corrupt heap state. The description explicitly identifies a concurrency trigger: two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can mutate module_delta during the free - this is a classic race/double-free (effectively CWE-415/CWE-362), though the input lists CWE as N/A. I disagree mildly with the input's AC:L: winning a double-free window between two concurrent readers is a timing-dependent race, which argues for AC:H in real-world reliability. No CISA KEV entry, no EPSS score, and no PoC are present in the input - the three references are git.kernel.org stable commits, i.e. the fix itself, not exploit code. The vuln.today 'this_week' label reflects a routine upstream kernel fix cadence, not evidence of active exploitation. Net: a legitimate local privilege-escalation/DoS-class kernel bug worth patching in the normal cycle, but there is no signal of widespread or active exploitation, and exploitation is gated by local access and a niche feature (below). Note also a tag/impact tension: the input tags this 'Information Disclosure', but the described mechanism is memory corruption (double-free), where any info leak would be secondary.

A local user with access to the kernel trace filesystem, on a system using the persistent boot-mapped ('last boot') ring buffer, opens the same last-boot trace data from two threads at once (e.g. tracing_open with O_TRUNC plus a trace_pipe/trace_buffers reader). Both readers pass the LAST_BOOT check and free module_delta twice while a module notifier may update it mid-free, corrupting kernel heap memory for potential privilege escalation or a kernel crash. No public exploit identified at time of analysis.