CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Fix race between update_event_fields and, event_define_fields<br /> <br /> The following sequence may leads race between event_define_fields()<br /> and update_event_fields():<br /> <br /> CPU0 (loads module A) CPU1 (loads module B)<br /> =============================== ===============================<br /> load_module(A) load_module(B)<br /> notifier_call_chain notifier_call_chain<br /> trace_module_notify trace_module_notify<br /> mutex_lock(&amp;event_mutex) trace_event_update_all()<br /> trace_module_add_events(A) down_write(&amp;trace_event_sem)<br /> __register_event(call_A)<br /> __add_event_to_tracers(call_A)<br /> event_define_fields(call_A)<br /> for each f: list_for_each_entry(field,<br /> list_add(&amp;f-&gt;link, &amp;class-&gt;fields, link)<br /> &amp;class-&gt;fields) field = class-&gt;fields-&gt;next;<br /> <br /> Where access to the class-&gt;fields is not protected by the event_mutex in<br /> trace_event_update_all().<br /> <br /> This produces the following panic:<br /> Unable to handle kernel access ... at virtual address 0000000000000018<br /> pc : update_event_fields+0xf8/0x368<br /> Call trace:<br /> update_event_fields+0xf8/0x368<br /> trace_event_update_all+0x7c/0x2b4<br /> trace_module_notify+0x4c/0x1dc<br /> notifier_call_chain+0x84/0x168<br /> blocking_notifier_call_chain_robust+0x64/0xd4<br /> load_module+0x10c8/0x123c<br /> __arm64_sys_finit_module+0x230/0x31c<br /> <br /> Fix by taking event_mutex in trace_event_update_all() before<br /> trace_event_sem.