{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix crash in print_graph_function_event()  tracing_set_tracer() assigns the flags of the newly selected tracer with:  \ttr-\u003ecurrent_trace_flags = t-\u003eflags ? : t-\u003etracer-\u003eflags;  If the new tracer defines neither static flags nor default flags, like hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy for it, and both operands are NULL, so tr-\u003ecurrent_trace_flags ends up being NULL as well.  The ring buffer is not cleared when switching tracers: it is reset inside tracer_init(), after current_trace_flags was already assigned. If the buffer still holds function_graph entries of the previous tracer, printing one of them dereferences the NULL pointer. This was hit by cat trace during an ftrace stress test:    BUG: kernel NULL pointer dereference, address: 0000000000000000   #PF: supervisor read access in kernel mode   RIP: 0010:print_graph_function_event+0xe/0x20   Call Trace:    s_show+0x4d/0x110    seq_read_iter+0x2d4/0x490    seq_read+0x130/0x170    vfs_read+0xb5/0x370    ksys_read+0x6d/0xe0    do_syscall_64+0xbc/0x450  The snapshot buffer is not reset at all, so this can be reproduced without a race:    echo function_graph \u003e /sys/kernel/tracing/current_tracer   echo 1 \u003e /sys/kernel/tracing/snapshot   echo hwlat \u003e /sys/kernel/tracing/current_tracer   cat /sys/kernel/tracing/snapshot  Rather than teaching every user of tr-\u003ecurrent_trace_flags about this corner case, make sure it is never NULL: when the newly selected tracer has no flags at all, tracing_set_tracer() falls back to a static empty no_tracer_flags. run_tracer_selftest() can hit the same case, so the same fallback is added there too. The existing users already handle opts == NULL, so these tracers keep behaving as before.",
  "id": "DEBIAN-CVE-2026-99141",
  "modified": "2026-10-29T05:47:32.296073754Z",
  "published": "2026-10-28T11:17:34.093Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99141"
    }
  ],
  "upstream": [
    "CVE-2026-99141"
  ]
}