An attacker can create a malicious ELF binary that contains a sh_link value beyond the valid range of the section header table. When a root‑level dtrace instance attaches to this process using traditional or user‑specified probes, the ELF parser reads memory beyond the bounds of the section cache array without a bounds check. This uninitialized or out‑of‑bounds heap read may first trigger a NULL pointer dereference that crashes the dtrace process, causing a denial‑of‑service (DoS). Depending on the heap layout, the read may also return a pointer that is under the attacker’s control, giving the attacker a foothold for further exploitation while dtrace operates with elevated privileges.

Oracle Linux installations that include the dtrace user‑space utility and have not received the patch addressing CVE‑2026‑35233 remain affected. No specific version range is listed. Administrators should verify if the proprietary kernel modules include this vulnerability.

The CVSS score of 4.4 indicates low to moderate severity. Because EPSS is not available, the global exploitation probability is unknown. The CVE is not listed in CISA KEV, implying no confirmed or widely reported exploitation. The attack vector requires a local unprivileged user to craft a malicious ELF binary and a privileged administrator to attach dtrace. In environments where dtrace is used extensively, repeated crashes could lead to a denial‑of‑service or, if an attacker can influence the resulting garbage pointer, a potential escalation path in a privileged context.