Heap Memory Vulnerability in Dtrace Process of Oracle Linux

CVE-2026-35233

What is CVE-2026-35233?

An unprivileged attacker may exploit a flaw in the Dtrace process of Oracle Linux by creating a specially crafted user-space process with a malicious ELF binary. This binary possesses an out-of-range sh_link field, leading to unsafe memory access when Dtrace attaches to this process. The ELF parser can unintentionally read beyond allocated memory bounds without proper checks, resulting in potential denial of service through a NULL pointer dereference or allowing exploitation through garbage pointers. This vulnerability underscores the importance of stringent security measures to prevent unauthorized access and safeguard sensitive operations.

References