CVE-2026-68174

Received Received - Intake

NULL Pointer Dereference in Linux Kernel Tracing

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68174

EUVD

EUVD-2026-55275

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a shared memory space in 'struct trace_event_call' causes a collision between the 'module' pointer and 'refcnt' atomic variable. For dynamic events, the 'refcnt' value may be misinterpreted as a module pointer, leading to invalid pointer dereferences and kernel crashes (Oops).

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to tracing functionality. Detection requires checking the kernel version and tracing subsystem behavior. No direct commands are provided in the context to detect this issue. Review kernel logs for Oops messages or trace event errors after dynamic event operations.

Impact Analysis

This vulnerability can cause system instability or crashes when dynamic events are used with module filtering. It may lead to kernel panics, data corruption, or denial of service if exploited maliciously or triggered under specific conditions.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux tracing subsystem that could cause system instability or crashes (Oops) when handling dynamic events. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA, as it is not a data exposure or access control flaw.

Mitigation Strategies

Apply the kernel patch that fixes the union collision issue in the tracing subsystem. Update to a Linux kernel version that includes the fix for CVE-2026-68174. Avoid using dynamic tracing events until the patch is applied.

Hi! I’m here to help you understand CVE-2026-68174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70