Linux
CVE-2026-99232: In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copy_from_user for the faultable syscall buffer syscall_copy_user_ar
CVE-2026-99232 Nov 2, 2026 Source: Vendor
In the Linux kernel, the following vulnerability has been resolved:
tracing/syscalls: Use copy_from_user for the faultable syscall buffer
syscall_copy_user_array() copies the buffer argument of faultable
syscalls (write, pwrite64, ...) with __copy_from_user(), which skips
access_ok(). Use copy_from_user() instead so a non-user address is
rejected and the entry is recorded as faulted.
It could be a security concern for machines that trust perf a bit too
much.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-99232
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
0 lines
No credit lines recorded on this release yet.