CVE-2026-99232

A flaw was found in the Linux kernel. A local attacker can trigger this issue by invoking faultable system calls with non-user memory addresses while tracing is active. Because the kernel fails to verify that the source address resides in user space before copying data into trace buffers, this flaw may lead to information disclosure of sensitive kernel memory.

This vulnerability is rated as Moderate severity because exploitation is confined to local environments and depends on active syscall tracing, which is disabled by default on standard Red Hat Enterprise Linux installations. An unprivileged local user cannot trigger trace event capture unless an administrator or privileged monitoring process explicitly enables tracing of faultable system calls. While unauthorized disclosure of kernel memory could expose sensitive system details, the defect does not allow arbitrary privilege escalation or system disruption directly.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.