CVE-2026-64451

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Linux Kernel Function Tracer

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from "function" (e.g., to "wakeup_rt"), tr->current_trace_flags can be NULL, leading to a NULL pointer dereference and kernel crash. The call chain that triggers this is: trace_options_write() -> __set_tracer_option() -> trace->set_flag() /* func_set_flag */ In func_set_flag(), the first operation is: if (!!set == !!(tr->current_trace_flags->val & bit)) This dereferences tr->current_trace_flags unconditionally. The safety check that guards against a non-function tracer: if (tr->current_trace != &function_trace) return 0; is placed *after* the dereference, which is too late. This was observed with the following crash dump: BUG: unable to handle page fault at 0000000000000000 RIP: func_set_flag+0xd Call Trace: __set_tracer_option+0x27 trace_options_write+0x75 vfs_write+0x12a ksys_write+0x66 do_syscall_64+0x5b RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202 RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080 The disassembly confirms the fault: func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current_trace_flags = NULL func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL At the time of the crash: tr->current_trace_flags = 0x0 (NULL) tr->current_trace = wakeup_rt_tracer (not function_trace) The scenario is that a process opens a function tracer option file (such as "func_stack_trace"), then the current tracer is switched to another tracer (e.g., "wakeup_rt"), which sets current_trace_flags to NULL. When the process subsequently writes to the option file, func_set_flag() is invoked and crashes on the NULL dereference. Fix this by moving the current_trace check before the current_trace_flags dereference, so that func_set_flag() returns early when the function tracer is not active.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64451

EUVD

EUVD-2026-48795

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's tracing subsystem. The issue occurs in the func_set_flag() function, which unconditionally dereferences tr->current_trace_flags before checking if the current tracer is the function tracer. When the active tracer is switched away from 'function' to another tracer like 'wakeup_rt', current_trace_flags becomes NULL, causing a kernel crash when func_set_flag() tries to access it.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and may not have direct network detection methods. Check if the kernel is vulnerable by verifying the kernel version and tracing functionality. Commands like 'uname -a' can show the kernel version. Look for crashes or kernel panics related to tracing operations in system logs using 'dmesg' or 'journalctl -k'.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when a process interacts with function tracer option files after the current tracer has been changed to a non-function tracer. This leads to denial of service as the entire system becomes unresponsive. It requires local access to trigger and does not allow privilege escalation or data theft.

Compliance Impact

This vulnerability is a kernel-level NULL pointer dereference in the Linux tracing subsystem. It causes system crashes but does not directly affect data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA compliance requirements. The impact is limited to system stability and availability during specific tracer operations.

Mitigation Strategies

Apply the kernel patch that fixes the NULL pointer dereference in func_set_flag(). Update the Linux kernel to a version that includes the fix. If immediate patching is not possible, avoid switching tracers while processes are writing to function tracer option files to prevent triggering the crash.

Hi! I’m here to help you understand CVE-2026-64451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70