CVE-2026-99247

In the Linux kernel, the following vulnerability has been resolved:

tracing: Do not initialize tracefs work if tracing is disabled

If trace buffer allocation fails during early boot (e.g. in early trace init() -> allocate trace buffers()), tracing disabled is left set to 1 and the global trace array events list remains uninitialized.

Later during boot, tracer init tracefs() (invoked via fs initcall) queues tracerfs init work asynchronously without checking if tracing was disabled. When tracer init tracefs work func() runs, it calls event trace init() and init tracer tracefs(&global trace, NULL) unconditionally. This leads to find event file() dereferencing an uninitialized tr->events list, causing an early boot NULL pointer dereference Oops:

BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000485be0 Oops: Kernel access of bad area, sig: 7 [#1] ... NIP [c000000000485be0] find event file+0x70/0x3c0 LR [c000000000448874] init tracer tracefs+0x274/0xc80 Call Trace: init tracer tracefs+0x274/0xc80 tracer init tracefs work func+0x50/0x320 process one work+0x1e8/0x5c0 worker thread+0x1dc/0x3d0 kthread+0x194/0x1b0 start kernel thread+0x14/0x18

Check tracing disabled at the beginning of tracer init tracefs work func() and return immediately if tracing is disabled or failed to initialize, preventing the crash.