CVE-2026-23088 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2026-23088 Interim 1 1 2026-03-05T00:17:34Z current 2026-03-05T00:17:34Z 2026-03-05T00:17:34Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2026-23088 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred: ~# cd /sys/kernel/tracing ~# echo 's:stack unsigned long stack[];' > dynamic_events ~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger ~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger The above creates a synthetic event that takes a stacktrace when a task schedules out in a non-running state and passes that stacktrace to the sched_switch event when that task schedules back in. It triggers the "stack" synthetic event that has a stacktrace as its field (called "stack"). ~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events ~# echo 'hist:keys=common_pid:s2=stack' >> events/synthetic/stack/trigger ~# echo 'hist:keys=common_pid:s3=$s2,i0=id:onmatch(synthetic.stack).trace(syscall_stack,$i0,$s3)' >> events/raw_syscalls/sys_exit/trigger The above makes another synthetic event called "syscall_stack" that attaches the first synthetic event (stack) to the sys_exit trace event and records the stacktrace from the stack event with the id of the system call that is exiting. When enabling this event (or using it in a historgram): ~# echo 1 > events/synthetic/syscall_stack/enable Produces a kernel crash! BUG: unable to handle page fault for address: 0000000000400010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 6 UID: 0 PID: 1257 Comm: bash Not tainted 6.16.3+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.3-1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:trace_event_raw_event_synth+0x90/0x380 Code: c5 00 00 00 00 85 d2 0f 84 e1 00 00 00 31 db eb 34 0f 1f 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 <49> 8b 04 24 48 83 c3 01 8d 0c c5 08 00 00 00 01 cd 41 3b 5d 40 0f RSP: 0018:ffffd2670388f958 EFLAGS: 00010202 RAX: ffff8ba1065cc100 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: fffff266ffda7b90 RDI: ffffd2670388f9b0 RBP: 0000000000000010 R08: ffff8ba104e76000 R09: ffffd2670388fa50 R10: ffff8ba102dd42e0 R11: ffffffff9a908970 R12: 0000000000400010 R13: ffff8ba10a246400 R14: ffff8ba10a710220 R15: fffff266ffda7b90 FS: 00007fa3bc63f740(0000) GS:ffff8ba2e0f48000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400010 CR3: 0000000107f9e003 CR4: 0000000000172ef0 Call Trace: <TASK> ? __tracing_map_insert+0x208/0x3a0 action_trace+0x67/0x70 event_hist_trigger+0x633/0x6d0 event_triggers_call+0x82/0x130 trace_event_buffer_commit+0x19d/0x250 trace_event_raw_event_sys_exit+0x62/0xb0 syscall_exit_work+0x9d/0x140 do_syscall_64+0x20a/0x2f0 ? trace_event_raw_event_sched_switch+0x12b/0x170 ? save_fpregs_to_fpstate+0x3e/0x90 ? _raw_spin_unlock+0xe/0x30 ? finish_task_switch.isra.0+0x97/0x2c0 ? __rseq_handle_notify_resume+0xad/0x4c0 ? __schedule+0x4b8/0xd00 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x1ef/0x2f0 ? do_fault+0x2e9/0x540 ? __handle_mm_fault+0x7d1/0xf70 ? count_memcg_events+0x167/0x1d0 ? handle_mm_fault+0x1d7/0x2e0 ? do_user_addr_fault+0x2c3/0x7f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reason is that the stacktrace field is not labeled as such, and is treated as a normal field and not as a dynamic event that it is. In trace_event_raw_event_synth() the event is field is still treated as a dynamic array, but the retrieval of the data is considered a normal field, and the reference is just the meta data: // Meta data is retrieved instead of a dynamic array ---truncated--- The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise High Availability Extension 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Legacy 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Live Patching 12 SP5 SUSE Linux Enterprise Live Patching 15 SP4 SUSE Linux Enterprise Live Patching 15 SP5 SUSE Linux Enterprise Live Patching 15 SP7 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Real Time Module 15 SP7 SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Legacy 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Legacy 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise Server for SAP applications 16.0 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 openSUSE Leap 15.6 cluster-md-kmp-default dlm-kmp-default gfs2-kmp-default kernel-default kernel-default-base kernel-default-devel kernel-default-extra kernel-default-kgraft kernel-default-kgraft-devel kernel-default-livepatch kernel-default-livepatch-devel kernel-default-man kernel-default-optional kernel-default-vdso kernel-devel kernel-devel-azure kernel-devel-rt kernel-macros kernel-rt kernel-source kernel-source-azure kernel-source-rt kernel-source-vanilla kselftests-kmp-default ocfs2-kmp-default reiserfs-kmp-default cluster-md-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 dlm-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 gfs2-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 ocfs2-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 kernel-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 kernel-source as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default-kgraft as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-default-kgraft-devel as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-default as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-source as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-default as a component of SUSE Linux Enterprise Micro 5.0 kernel-default as a component of SUSE Linux Enterprise Micro 5.1 kernel-rt as a component of SUSE Linux Enterprise Micro 5.1 kernel-default as a component of SUSE Linux Enterprise Micro 5.2 kernel-rt as a component of SUSE Linux Enterprise Micro 5.2 kernel-source as a component of SUSE Linux Enterprise Micro 5.2 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.2 kernel-default as a component of SUSE Linux Enterprise Micro 5.3 kernel-rt as a component of SUSE Linux Enterprise Micro 5.3 kernel-source as a component of SUSE Linux Enterprise Micro 5.3 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.3 kernel-default as a component of SUSE Linux Enterprise Micro 5.4 kernel-rt as a component of SUSE Linux Enterprise Micro 5.4 kernel-source as a component of SUSE Linux Enterprise Micro 5.4 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.4 kernel-default as a component of SUSE Linux Enterprise Micro 5.5 kernel-macros as a component of SUSE Linux Enterprise Micro 5.5 kernel-source as a component of SUSE Linux Enterprise Micro 5.5 kernel-devel-rt as a component of SUSE Linux Enterprise Micro 5.5 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.5 kernel-default as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-default-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-macros as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-source as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-default as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 kernel-source as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 reiserfs-kmp-default as a component of SUSE Linux Enterprise Module for Legacy 15 SP7 kernel-default as a component of SUSE Linux Enterprise Module for Legacy 15 SP7 kernel-source as a component of SUSE Linux Enterprise Module for Legacy 15 SP7 kernel-devel-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP7 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP7 kernel-default as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default-base as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default-devel as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-source as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP4-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP5-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security kernel-source as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security kernel-default as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 15 SP1-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP4-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP5-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise Server 15 SP6-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise Server 15 SP6-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise Server 15 SP6-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP6-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP6-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise Server 15 SP6-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP6-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP6-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP6-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP6-LTSS kernel-default as a component of SUSE Linux Enterprise Server 16.0 kernel-devel as a component of SUSE Linux Enterprise Server 16.0 kernel-macros as a component of SUSE Linux Enterprise Server 16.0 kernel-source as a component of SUSE Linux Enterprise Server 16.0 kernel-source-vanilla as a component of SUSE Linux Enterprise Server 16.0 kernel-devel-azure as a component of SUSE Linux Enterprise Server 16.0 kernel-source-azure as a component of SUSE Linux Enterprise Server 16.0 kernel-default as a component of SUSE Linux Enterprise Server Teradata 12 SP3 kernel-source as a component of SUSE Linux Enterprise Server Teradata 12 SP3 kernel-default as a component of SUSE Linux Enterprise Server Teradata 15 SP4 kernel-source as a component of SUSE Linux Enterprise Server Teradata 15 SP4 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 cluster-md-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 dlm-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 gfs2-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 ocfs2-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 cluster-md-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 dlm-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 gfs2-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 ocfs2-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-default as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-devel as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-macros as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-source as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-source-vanilla as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-devel-azure as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-source-azure as a component of SUSE Linux Enterprise Server for SAP applications 16.0 kernel-default-extra as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 kernel-default as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 kernel-source as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 kernel-default as a component of SUSE Linux Micro 6.0 kernel-devel as a component of SUSE Linux Micro 6.0 kernel-macros as a component of SUSE Linux Micro 6.0 kernel-source as a component of SUSE Linux Micro 6.0 kernel-devel-rt as a component of SUSE Linux Micro 6.0 kernel-source-rt as a component of SUSE Linux Micro 6.0 kernel-default as a component of SUSE Linux Micro 6.1 kernel-devel as a component of SUSE Linux Micro 6.1 kernel-macros as a component of SUSE Linux Micro 6.1 kernel-source as a component of SUSE Linux Micro 6.1 kernel-devel-rt as a component of SUSE Linux Micro 6.1 kernel-source-rt as a component of SUSE Linux Micro 6.1 kernel-devel-rt as a component of SUSE Real Time Module 15 SP7 kernel-source-rt as a component of SUSE Real Time Module 15 SP7 cluster-md-kmp-default as a component of openSUSE Leap 15.6 dlm-kmp-default as a component of openSUSE Leap 15.6 gfs2-kmp-default as a component of openSUSE Leap 15.6 kernel-default as a component of openSUSE Leap 15.6 kernel-default-devel as a component of openSUSE Leap 15.6 kernel-default-extra as a component of openSUSE Leap 15.6 kernel-default-livepatch as a component of openSUSE Leap 15.6 kernel-default-livepatch-devel as a component of openSUSE Leap 15.6 kernel-default-optional as a component of openSUSE Leap 15.6 kernel-default-vdso as a component of openSUSE Leap 15.6 kselftests-kmp-default as a component of openSUSE Leap 15.6 ocfs2-kmp-default as a component of openSUSE Leap 15.6 reiserfs-kmp-default as a component of openSUSE Leap 15.6 kernel-devel as a component of openSUSE Leap 15.6 kernel-macros as a component of openSUSE Leap 15.6 kernel-source as a component of openSUSE Leap 15.6 kernel-source-vanilla as a component of openSUSE Leap 15.6 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash occurred: ~# cd /sys/kernel/tracing ~# echo 's:stack unsigned long stack[];' > dynamic_events ~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger ~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger The above creates a synthetic event that takes a stacktrace when a task schedules out in a non-running state and passes that stacktrace to the sched_switch event when that task schedules back in. It triggers the "stack" synthetic event that has a stacktrace as its field (called "stack"). ~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events ~# echo 'hist:keys=common_pid:s2=stack' >> events/synthetic/stack/trigger ~# echo 'hist:keys=common_pid:s3=$s2,i0=id:onmatch(synthetic.stack).trace(syscall_stack,$i0,$s3)' >> events/raw_syscalls/sys_exit/trigger The above makes another synthetic event called "syscall_stack" that attaches the first synthetic event (stack) to the sys_exit trace event and records the stacktrace from the stack event with the id of the system call that is exiting. When enabling this event (or using it in a historgram): ~# echo 1 > events/synthetic/syscall_stack/enable Produces a kernel crash! BUG: unable to handle page fault for address: 0000000000400010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 6 UID: 0 PID: 1257 Comm: bash Not tainted 6.16.3+deb14-amd64 #1 PREEMPT(lazy) Debian 6.16.3-1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:trace_event_raw_event_synth+0x90/0x380 Code: c5 00 00 00 00 85 d2 0f 84 e1 00 00 00 31 db eb 34 0f 1f 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 <49> 8b 04 24 48 83 c3 01 8d 0c c5 08 00 00 00 01 cd 41 3b 5d 40 0f RSP: 0018:ffffd2670388f958 EFLAGS: 00010202 RAX: ffff8ba1065cc100 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: fffff266ffda7b90 RDI: ffffd2670388f9b0 RBP: 0000000000000010 R08: ffff8ba104e76000 R09: ffffd2670388fa50 R10: ffff8ba102dd42e0 R11: ffffffff9a908970 R12: 0000000000400010 R13: ffff8ba10a246400 R14: ffff8ba10a710220 R15: fffff266ffda7b90 FS: 00007fa3bc63f740(0000) GS:ffff8ba2e0f48000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400010 CR3: 0000000107f9e003 CR4: 0000000000172ef0 Call Trace: <TASK> ? __tracing_map_insert+0x208/0x3a0 action_trace+0x67/0x70 event_hist_trigger+0x633/0x6d0 event_triggers_call+0x82/0x130 trace_event_buffer_commit+0x19d/0x250 trace_event_raw_event_sys_exit+0x62/0xb0 syscall_exit_work+0x9d/0x140 do_syscall_64+0x20a/0x2f0 ? trace_event_raw_event_sched_switch+0x12b/0x170 ? save_fpregs_to_fpstate+0x3e/0x90 ? _raw_spin_unlock+0xe/0x30 ? finish_task_switch.isra.0+0x97/0x2c0 ? __rseq_handle_notify_resume+0xad/0x4c0 ? __schedule+0x4b8/0xd00 ? restore_fpregs_from_fpstate+0x3c/0x90 ? switch_fpu_return+0x5b/0xe0 ? do_syscall_64+0x1ef/0x2f0 ? do_fault+0x2e9/0x540 ? __handle_mm_fault+0x7d1/0xf70 ? count_memcg_events+0x167/0x1d0 ? handle_mm_fault+0x1d7/0x2e0 ? do_user_addr_fault+0x2c3/0x7f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reason is that the stacktrace field is not labeled as such, and is treated as a normal field and not as a dynamic event that it is. In trace_event_raw_event_synth() the event is field is still treated as a dynamic array, but the retrieval of the data is considered a normal field, and the reference is just the meta data: // Meta data is retrieved instead of a dynamic array ---truncated--- CVE-2026-23088 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:reiserfs-kmp-default SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:cluster-md-kmp-default SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:dlm-kmp-default SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:gfs2-kmp-default SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:ocfs2-kmp-default SUSE Linux Enterprise Live Patching 12 SP5:kernel-default SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-devel SUSE Linux Enterprise Live Patching 12 SP5:kernel-source SUSE Linux Enterprise Live Patching 15 SP4:kernel-default SUSE Linux Enterprise Live Patching 15 SP4:kernel-default-livepatch SUSE Linux Enterprise Live Patching 15 SP4:kernel-default-livepatch-devel SUSE Linux Enterprise Live Patching 15 SP4:kernel-source SUSE Linux Enterprise Live Patching 15 SP5:kernel-default SUSE Linux Enterprise Live Patching 15 SP5:kernel-default-livepatch SUSE Linux Enterprise Live Patching 15 SP5:kernel-default-livepatch-devel SUSE Linux Enterprise Live Patching 15 SP5:kernel-source SUSE Linux Enterprise Micro 5.0:kernel-default SUSE Linux Enterprise Micro 5.1:kernel-default SUSE Linux Enterprise Micro 5.1:kernel-rt SUSE Linux Enterprise Micro 5.2:kernel-default SUSE Linux Enterprise Micro 5.2:kernel-rt SUSE Linux Enterprise Micro 5.2:kernel-source SUSE Linux Enterprise Micro 5.2:kernel-source-rt SUSE Linux Enterprise Micro 5.3:kernel-default SUSE Linux Enterprise Micro 5.3:kernel-rt SUSE Linux Enterprise Micro 5.3:kernel-source SUSE Linux Enterprise Micro 5.3:kernel-source-rt SUSE Linux Enterprise Micro 5.4:kernel-default SUSE Linux Enterprise Micro 5.4:kernel-rt SUSE Linux Enterprise Micro 5.4:kernel-source SUSE Linux Enterprise Micro 5.4:kernel-source-rt SUSE Linux Enterprise Micro 5.5:kernel-default SUSE Linux Enterprise Micro 5.5:kernel-devel-rt SUSE Linux Enterprise Micro 5.5:kernel-macros SUSE Linux Enterprise Micro 5.5:kernel-source SUSE Linux Enterprise Micro 5.5:kernel-source-rt SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default-base SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default-devel SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-source SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:kernel-default SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:kernel-source SUSE Linux Enterprise Server 12 SP5-LTSS:cluster-md-kmp-default SUSE Linux Enterprise Server 12 SP5-LTSS:dlm-kmp-default SUSE Linux Enterprise Server 12 SP5-LTSS:gfs2-kmp-default SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP5-LTSS:ocfs2-kmp-default SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-base SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-man SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP1-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP2-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP3-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP4-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP4-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP5-LTSS:cluster-md-kmp-default SUSE Linux Enterprise Server 15 SP5-LTSS:dlm-kmp-default SUSE Linux Enterprise Server 15 SP5-LTSS:gfs2-kmp-default SUSE Linux Enterprise Server 15 SP5-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP5-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP5-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP5-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP5-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP5-LTSS:ocfs2-kmp-default SUSE Linux Enterprise Server 15 SP5-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server Teradata 12 SP3:kernel-default SUSE Linux Enterprise Server Teradata 12 SP3:kernel-source SUSE Linux Enterprise Server Teradata 15 SP4:kernel-default SUSE Linux Enterprise Server Teradata 15 SP4:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-default SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-default-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-devel SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-macros SUSE Linux Enterprise Server for SAP Applications 15 SP4:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP4:reiserfs-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP5:cluster-md-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP5:dlm-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP5:gfs2-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP5:kernel-default SUSE Linux Enterprise Server for SAP Applications 15 SP5:kernel-default-devel SUSE Linux Enterprise Server for SAP Applications 15 SP5:kernel-devel SUSE Linux Enterprise Server for SAP Applications 15 SP5:kernel-macros SUSE Linux Enterprise Server for SAP Applications 15 SP5:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP5:ocfs2-kmp-default SUSE Linux Enterprise Server for SAP Applications 15 SP5:reiserfs-kmp-default moderate 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H