Oracle Linux 8/9/10 ELF Parser sh_link null pointer dereference

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Oracle Linux 8/9/10. This vulnerability affects unknown code of the component ELF Parser. This manipulation of the argument sh_link causes null pointer dereference. This vulnerability is handled as CVE-2026-35233. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in Oracle Linux 8/9/10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component ELF Parser. The manipulation of the argument sh_link with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.

The advisory is shared at linux.oracle.com. This vulnerability is known as CVE-2026-35233 since 04/01/2026. The exploitation appears to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/24/2026).

The vulnerability scanner Nessus provides a plugin with the ID 322226 (Oracle Solaris Critical Patch Update : jun2026_SRU11_4_93_221_2), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (322226) and EUVD (EUVD-2026-26702). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Oracle

Name

• Linux

Version

• 8
• 9
• 10

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion