{"id":"AZL-112535","summary":"CVE-2026-99219 affecting package kernel 6.6.159.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Initialize modname and offset in print_rec()\n\nprint_rec() leaves 'modname' and 'offset' uninitialized and\nkallsyms_lookup() only sets them on success. When the lookup fails like\nwhen a module is being loaded or unloaded, 'modname' holds a garbage\nvalue, passes the 'if (modname)' check, and is dereferenced by\nseq_printf().\n\n  Oops: general protection fault\n  RIP: 0010:string+0x48/0xe0\n  Call Trace:\n   vsnprintf+0x1f5/0x650\n   seq_printf+0x8e/0xb0\n   print_rec+0x6c/0xc0\n   t_show+0x4c/0x440\n   seq_read_iter+0x119/0x480\n\nThis can be triggered by reading available_filter_functions while a\nmodule is being loaded or unloaded.\n\nInitialize both variables so a failed lookup skips the module name.","modified":"2026-11-03T14:18:15.524399495Z","published":"2026-11-02T16:17:45Z","upstream":["CVE-2026-99219"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99219"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.159.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112535.json"}}],"schema_version":"1.9.2"}