CVE-2026-98076

A flaw was found in the Linux kernel's tracing subsystem. When dynamic probe events are configured with multiple probes, removing the initial probe frees its argument name and type strings while the event remains registered. A local user with administrative or tracing privileges can trigger a use-after-free condition by querying or filtering the remaining event, leading to a system crash and denial of service or potential memory corruption.

This vulnerability is rated with a Moderate severity because exploitation requires local access with elevated privileges, specifically administrative or tracing capabilities, limiting the attack surface to authorized operators and resulting primarily in system denial of service. By default on Red Hat Enterprise Linux, interaction with the kernel tracing infrastructure is restricted to root or users possessing administrative tracing capabilities. Earlier distributions, including Red Hat Enterprise Linux 7 and 8, lack the vulnerable probe management logic and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.