CVE-2026-64451

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Fix NULL pointer dereference in func_set_flag()<br /> <br /> func_set_flag() dereferences tr-&gt;current_trace_flags before verifying<br /> that the current tracer is actually the function tracer. When the active<br /> tracer has been switched away from "function" (e.g., to "wakeup_rt"),<br /> tr-&gt;current_trace_flags can be NULL, leading to a NULL pointer<br /> dereference and kernel crash.<br /> <br /> The call chain that triggers this is:<br /> <br /> trace_options_write()<br /> -&gt; __set_tracer_option()<br /> -&gt; trace-&gt;set_flag() /* func_set_flag */<br /> <br /> In func_set_flag(), the first operation is:<br /> <br /> if (!!set == !!(tr-&gt;current_trace_flags-&gt;val &amp; bit))<br /> <br /> This dereferences tr-&gt;current_trace_flags unconditionally. The safety<br /> check that guards against a non-function tracer:<br /> <br /> if (tr-&gt;current_trace != &amp;function_trace)<br /> return 0;<br /> <br /> is placed *after* the dereference, which is too late.<br /> <br /> This was observed with the following crash dump:<br /> <br /> BUG: unable to handle page fault at 0000000000000000<br /> RIP: func_set_flag+0xd<br /> <br /> Call Trace:<br /> __set_tracer_option+0x27<br /> trace_options_write+0x75<br /> vfs_write+0x12a<br /> ksys_write+0x66<br /> do_syscall_64+0x5b<br /> <br /> RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202<br /> RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001<br /> RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080<br /> <br /> The disassembly confirms the fault:<br /> <br /> func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr-&gt;current_trace_flags = NULL<br /> func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL<br /> <br /> At the time of the crash:<br /> tr-&gt;current_trace_flags = 0x0 (NULL)<br /> tr-&gt;current_trace = wakeup_rt_tracer (not function_trace)<br /> <br /> The scenario is that a process opens a function tracer option file (such<br /> as "func_stack_trace"), then the current tracer is switched to another<br /> tracer (e.g., "wakeup_rt"), which sets current_trace_flags to NULL. When<br /> the process subsequently writes to the option file, func_set_flag() is<br /> invoked and crashes on the NULL dereference.<br /> <br /> Fix this by moving the current_trace check before the<br /> current_trace_flags dereference, so that func_set_flag() returns early<br /> when the function tracer is not active.