CVE-2026-68146

Source
https://cve.org/CVERecord?id=CVE-2026-68146
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68146.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68146
Downstream
Published
2026-08-10T11:59:11.273Z
Modified
2026-08-18T03:31:21.954791136Z
Summary
ftrace: Add global mutex to serialize trace_parser access
Details

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Add global mutex to serialize trace_parser access

In ftrace, the trace_parser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input.

The affected handler paths and their specific functions are: - Open paths: ftraceregexopen(), ftracegraphopen() - Write paths: ftraceregexwrite(), ftracegraphwrite() - Release paths: ftraceregexrelease(), ftracegraphrelease()

If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior.

Fix this by adding a global mutex, parserlock, to serialize all access to traceparser across write and release paths, preventing concurrent corruption of parser state.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68146.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
689fd8b65d669b96d612ccc37d6fb87bf7ed6907
Fixed
3d0dd138a06c782f8b755cd1b6f9909494514ce1
Fixed
90be137813e1a5bdfd671e40fe28004fb959d3e4
Fixed
65bf73bee1a4f3722208ae46afc0fa5de76b9a0a
Fixed
e807c9193d9493c7a0d039158ebb955050a76df1
Fixed
7720b63bcef3f54c7fe288774b720a227d54a306

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68146.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.32
Fixed
6.6.148
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.101
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.42
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68146.json"