Linux Kernel CVE-2026-99238

Requires a kernel built with tracing enabled and actually using persistent/named trace instances (ftrace_trace_arrays), plus local access with the privileges to (a) load or unload a kernel module and (b) create/remove a trace instance directory under tracefs - operations that normally demand root or CAP_SYS_ADMIN/CAP_SYS_MODULE. The trigger per the description is a concurrent module load/unload and instance rmdir, so exploitation depends on winning that race window. Limiting factors: no remote vector (AV:L, local only), already-privileged operations are needed, the specific persistent-instance tracing feature must be in use, and the timing-sensitive race reduces reliability.

The input assigns CVSS 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning this is a local-only, non-remote issue requiring some existing privilege - not a network-facing flaw. No KEV status is present, so there is no confirmed active exploitation; no EPSS score was supplied, and no SSVC exploitation/automatable/technical-impact triad was provided, leaving those signals unknown. The only references are three kernel.org stable git commits (the fixes themselves), i.e. no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency local kernel bug. The description makes clear this is a use-after-free driven by a race: trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock while a concurrent instance rmdir frees a trace_array under that lock. One caveat worth flagging: the input Tags label this 'Information Disclosure', yet the CVSS vector claims full C:H/I:H/A:H, which describes kernel memory corruption with escalation/crash potential rather than mere disclosure - treat the impact as broader than the tag implies. Also note the CVSS AC:L sits uneasily with a timing-dependent race; winning that race is not guaranteed, which realistically lowers practical exploitability below what AC:L suggests. Net: a real local kernel hardening fix to deploy promptly, not a drop-everything remote emergency.

A local actor holding the privileges needed to load/unload kernel modules and to create and remove persistent trace instances under tracefs triggers a module load or unload at the same moment another thread removes a trace instance directory. The module notifier then walks into a trace_array that the concurrent rmdir has already freed under trace_types_lock, producing a use-after-free in kernel memory that can crash the system or be groomed toward privilege escalation. No public exploit was identified; success is timing-dependent because it requires winning the race described in the fix.