CVE-2026-97933

Executive Summary

CVE-2026-97933 is a use-after-free (UAF) vulnerability in the Linux kernel tracing subsystem, specifically in the handling of tracer options files associated with trace_array instances. A race condition allows a trace_array element (from the topts array) to be freed while a tracer options file remains open, leading to a use-after-free when the kernel later dereferences the stale element to take a reference on the trace_array. Exploitation requires local access with the ability to open tracing option files and concurrently delete trace instances, typically requiring privileges such as CAP_SYS_ADMIN or membership in a privileged group (e.g., trace group or root). Successful exploitation can lead to kernel memory corruption, potentially resulting in privilege escalation, denial of service, or code execution in kernel context.

Technical Analysis

The Linux kernel tracing infrastructure maintains per-instance trace_array structures, each of which contains a topts array whose elements describe tracer options. When a tracer options file is opened by a user, the inode->i_private pointer references an element within the topts array. The open handler uses this element to locate the corresponding trace_array and increment its reference counter, ensuring the trace instance cannot be torn down while the file descriptor remains valid.

The vulnerability arises because the element referenced by inode->i_private is itself freed when the trace instance (trace_array) is removed via instance deletion. There is no synchronization preventing the deletion of the instance between the time the file is opened and the time the element is dereferenced to increment the trace_array reference count. This constitutes a classic use-after-free (CWE-416): the kernel accesses freed memory (the topts element) in an attempt to resolve the parent trace_array.

The remediation described in the NVD entry introduces a helper function, trace_array_tracer_options_get(), which takes the address of the element passed via inode->i_private and searches all trace_array instances under a lock to identify the one whose topts array range contains that address. Upon a match, the correct trace_array reference is incremented. This avoids relying on the freed element's internal data for trace_array resolution.

The description also acknowledges a residual, practically negligible race: if an administrator deletes and recreates trace instances rapidly, the memory of the old topts array could match the memory of a new trace_array, potentially opening an option from the wrong instance. The commit message explicitly states this scenario is accepted because such administrative behavior is considered unrealistic.

Attack surface: local, requiring the ability to open a tracer options file (typically found under the tracing filesystem, e.g., /sys/kernel/tracing/ or /sys/kernel/debug/tracing/) and concurrently trigger instance removal. The vulnerability class is a race-condition-driven use-after-free, which in kernel context can be escalated to arbitrary memory corruption if the freed slab object is reallocated with attacker-controlled data.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-97933. The attack chain below is inferred strictly from the vulnerability class (use-after-free) and the mechanics described in the NVD description. No function names, endpoints, or parameters beyond those explicitly stated (trace_array, topts, trace_array_tracer_options_get(), inode->i_private) are assumed.

1. Reconnaissance / target identification: An attacker with local access to a Linux system identifies that kernel tracing is enabled and that they possess sufficient privileges to open tracer option files and manage trace instances. This typically requires root, CAP_SYS_ADMIN, or membership in a group granted access to the tracing filesystem.

2. Triggering the flaw class: The attacker opens a tracer options file, causing the kernel to store the address of a topts array element in the file's inode->i_private. Concurrently (or shortly thereafter), the attacker causes the associated trace instance to be removed. Because instance removal frees the topts array element, the file's inode->i_private now points to freed memory. Subsequent operations on the open file — specifically the dereference used to locate and reference the trace_array — access this freed memory.

3. Payload / execution method (vulnerability-class level): In a use-after-free scenario, the attacker attempts to reallocate the freed slab memory with controlled data before the stale pointer is dereferenced. Because the exact allocation size and slab cache depend on kernel configuration and topts array layout, a reliable exploit would require heap grooming. There is no public information confirming a successful, weaponized heap spray for this specific CVE. At the vulnerability-class level, successful reclamation leads to the kernel treating attacker-controlled bytes as a trace_array pointer or as fields used during the reference-count increment, culminating in memory corruption.

4. Post-exploitation impact: Depending on the corrupted data, outcomes include kernel panic/denial of service, privilege escalation via corrupted kernel structures, or arbitrary code execution in ring 0. Because the vulnerable path runs in kernel context, any successful corruption bypasses user-space isolation entirely.

Impact Assessment

CVE-2026-97933 is a local-use-after-free affecting the Linux kernel tracing subsystem. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a local attack vector, high attack complexity due to the race condition, high privileges required (typically root or CAP_SYS_ADMIN to manipulate tracing instances), no user interaction, and high confidentiality, integrity, and availability impact.

Business impact is concentrated on systems where kernel tracing is actively used or where untrusted local users can access the tracing interface. In multi-tenant environments (containers, shared hosts, CI/CD runners), a privileged container breakout or escape from a constrained administrative context could be possible if the tracing filesystem is mounted and writable. The blast radius includes any host on which the vulnerable tracing code path is reachable; however, the high privilege prerequisite narrows the practical threat to post-authentication local escalation or container-escape scenarios rather than remote unauthenticated compromise. No ransomware, APT, or exploit-in-the-wild activity has been associated with this CVE. CISA KEV status: not listed.

Detection Guidance

Sigma Rule

title: Linux Kernel Tracing Trace_Array Use-After-Free Exploitation Attempt
id: 9f2a7c3e-1b4d-4e6a-9c8f-3d5e6a7b8c9d
status: experimental
description: Detects suspicious concurrent access to Linux kernel tracing option files and trace instance removal that may indicate CVE-2026-97933 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97933
author: valtersit.com
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection_open:
    type: 'SYSCALL'
    syscall: 'openat'
    key: 'trace_options'
  selection_delete:
    type: 'SYSCALL'
    syscall: 'rmdir'
    exe|endswith:
      - '/tracing/instances'
  timeframe: 5s
  condition: selection_open and selection_delete
falsepositives:
  - Legitimate tracing administration workflows
  - Debugging scripts that create and destroy instances
level: high

YARA Rule

rule CVE_2026_97933_Linux_TraceArray_UAF
{
    meta:
        description = "Detects references to the trace_array tracer options use-after-free helper in kernel binaries or crash artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97933"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "trace_array_tracer_options_get" ascii
        $s2 = "topts" ascii
        $s3 = "trace_array" ascii
        $s4 = "i_private" ascii

    condition:
        (uint32(0) == 0x464c457f) and 2 of ($s*)
}

Suricata IDS Rule

alert any any -> any any (msg:"CVE-2026-97933 Linux kernel trace_array use-after-free attempt - suspicious tracing instance churn"; flow:to_server; content:"/tracing/instances"; nocase; content:"trace_options"; nocase; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-admin; sid:9000979; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5s
  [ any where event.category == "file" and file.path : "*/tracing/instances*" and event.action == "deletion" ]
  [ any where event.category == "file" and file.path : "*/tracing/*options*" and event.action == "access" ]

Splunk SPL Query

index=linux sourcetype=auditd (syscall=openat OR syscall=rmdir)
| eval target=coalesce(name, path, file)
| search target="*tracing*" OR target="*trace_options*" OR target="*instances*"
| stats count values(syscall) as syscalls values(target) as paths by host, pid
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="linux,kernel,tracing,">
  <rule id="100979" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.key">trace_options</field>
    <description>CVE-2026-97933: Suspicious access to tracing option files potentially triggering trace_array use-after-free</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="100980" level="12">
    <if_sid>80700</if_sid>
    <match>tracing/instances</match>
    <description>CVE-2026-97933: Trace instance removal concurrent with tracer option file access</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to the kernel tracing filesystem. Limit who can create/delete trace instances and open tracer option files. This typically means removing non-root users from privileged groups and ensuring CAP_SYS_ADMIN is not granted to untrusted processes or containers.
   • Do not mount the tracing/debug filesystem (/sys/kernel/tracing, /sys/kernel/debug/tracing) into containers unless absolutely required.
   • Avoid using tracing in production workloads where untrusted local users or containers can interact with the interface.
   • Consider disabling kernel tracing entirely (kernel.trace_clock and related configs) if not operationally required, reducing the attack surface.

2. Patch/upgrade steps:

   • No upstream patch or vendor fix is currently tracked for CVE-2026-97933. Monitor the Linux kernel stable and longterm release channels for a commit that adds the trace_array_tracer_options_get() helper function described in the NVD entry.
   • Once a patched kernel version is released, test in a staging environment and perform a controlled upgrade. Follow your distribution's kernel update process (e.g., dnf update kernel, apt upgrade linux-image-*).
   • Verify the patch by checking that the kernel no longer references the freed topts element; the fix refactors trace_array resolution to search under a lock.

3. Long-term hardening:

   • Apply mandatory access control (SELinux/AppArmor) policies that confine access to the tracing subsystem.
   • Use kernel live patching or gVisor-style sandboxing where feasible to reduce exposure.
   • Enable Kernel Address Space Layout Randomization (KASLR) and hardened slab allocators (e.g., CONFIG_SLAB_FREELIST_HARDENED) to make UAF exploitation less reliable.
   • Maintain an inventory of kernel versions and subscribe to linux-distros and CVE feeds for prompt notification of the eventual fix.

References

1. NVD — CVE-2026-97933: https://nvd.nist.gov/vuln/detail/CVE-2026-97933
2. Linux kernel tracing documentation (official): https://www.kernel.org/doc/html/latest/trace/
3. Linux kernel mailing list (LKML) — tracing subsystem discussions and instance management
4. CWE-416 Use After Free — MITRE: https://cwe.mitre.org/data/definitions/416.html
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not currently listed)

No known threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-97933 at this time.