Linux Kernel up to 6.18.5 tracing recursion

Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.18.5. This affects an unknown part of the component tracing. Executing a manipulation can lead to recursion. This vulnerability appears as CVE-2026-23138. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.18.5 and classified as critical. This vulnerability affects an unknown functionality of the component tracing. The manipulation with an unknown input leads to a recursion vulnerability. The CWE definition for the vulnerability is CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tracing: Add recursion protection in kernel stack trace recording A bug was reported about an infinite recursion caused by tracing the rcu events with the kernel stack trace trigger enabled. The stack trace code called back into RCU which then called the stack trace again. Expand the ftrace recursion protection to add a set of bits to protect events from recursion. Each bit represents the context that the event is in (normal, softirq, interrupt and NMI). Have the stack trace code use the interrupt context to protect against recursion. Note, the bug showed an issue in both the RCU code as well as the tracing stacktrace code. This only handles the tracing stack trace side of the bug. The RCU fix will be handled separately.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-23138 since 01/13/2026. The exploitation appears to be difficult. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 299078 (Linux Distros Unpatched Vulnerability : CVE-2026-23138), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.6 eliminates this vulnerability. Applying the patch 5b7f91acffd2c4c000971553d22efa1e1bb4feae/5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (299078). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion