CVE-2026-68174
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
10/08/2026
Last modified:
17/08/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
tracing: Fix union collision of module and refcnt for dynamic events<br />
<br />
In &#39;struct trace_event_call&#39;, the &#39;module&#39; pointer and the &#39;refcnt&#39;<br />
atomic variable share the same memory space in a union. For dynamic<br />
events, the union member is &#39;refcnt&#39;, which acts as an active<br />
reference counter.<br />
<br />
When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or<br />
wprobe) has a non-zero reference count (e.g. due to active event<br />
triggers or perf attachments), its &#39;call->module&#39; evaluates to a<br />
small non-zero integer instead of NULL.<br />
<br />
When filtering or setting events for a specific module (e.g., writing<br />
&#39;:mod:&#39; to &#39;set_event&#39;), the code in<br />
&#39;__ftrace_set_clr_event_nolock()&#39; and &#39;update_event_fields()&#39; reads<br />
&#39;call->module&#39; directly without checking whether the event is dynamic.<br />
This causes the kernel to treat the small integer (refcnt) as a<br />
&#39;struct module&#39; pointer, leading to a NULL/invalid pointer dereference<br />
(Oops) when dereferencing the module name.<br />
<br />
Fix this by ensuring that the &#39;TRACE_EVENT_FL_DYNAMIC&#39; flag is checked<br />
before treating &#39;call->module&#39; as a valid pointer in these code paths.