CVE-2026-35233 Details
Description
An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.
A vulnerability exists in Oracle Linux versions 8, 9, and 10, allowing an unprivileged attacker to create a user-space process with a harmful ELF binary that includes an out-of-range sh_link field. When the root-level DTrace tool attaches to this process, the ELF parser improperly reads heap memory beyond the allocated section cache array, lacking any bounds check. This flaw leads to an uninitialized or out-of-bounds heap read, which can cause a NULL pointer dereference, crashing the DTrace process and creating a denial-of-service condition. Alternatively, depending on the heap layout, it could result in a read-then-use of a garbage pointer controlled by adjacent allocations, potentially allowing further exploitation in a privileged context.
Users can apply the available patches by referencing the Oracle Linux Errata ELSA-2026-50249, ELSA-2026-50250, and ELSA-2026-50251.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://linux.oracle.com/cve/CVE-2026-35233.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oracle linux | 8 - 9 0 10 0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | New CVE Received | [email protected] |