CVE-2026-72385

Received Received - Intake

NULL Pointer Dereference in Linux Kernel Fprobe

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry() fprobe_fgraph_entry() sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcu_read_lock() only. A fprobe registered on an already-live ip can become visible between the two walks, so the fill walk processes an exit_handler the sizing walk did not count and used runs past reserved_words. If the sizing walk counted nothing, fgraph_data is NULL and the first write_fprobe_header() faults: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:fprobe_fgraph_entry+0xa38/0xf10 kernel/trace/fprobe.c:167 Call Trace: <TASK> function_graph_enter_regs+0x44c/0xa10 kernel/trace/fgraph.c:677 ftrace_graph_func+0xc5/0x140 arch/x86/kernel/ftrace.c:671 __kernel_text_address+0x9/0x40 kernel/extable.c:78 arch_stack_walk+0x117/0x170 arch/x86/kernel/stacktrace.c:26 kmem_cache_free+0x188/0x580 mm/slub.c:6378 tcp_data_queue+0x18d/0x6550 net/ipv4/tcp_input.c:5590 [...] </TASK> The list cannot be frozen across the two walks, so skip a node that does not fit the reservation and count it as missed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72385

EUVD

EUVD-2026-59284

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a NULL pointer dereference flaw exists in the fprobe_fgraph_entry function. The issue occurs when the function sizes a shadow-stack reservation in one walk and fills it in a second walk, both under RCU read lock. A race condition can cause the fill walk to process an exit handler not counted in the sizing walk, leading to memory access beyond reserved space and a kernel oops.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and requires kernel-level inspection. Detection involves checking kernel logs for NULL pointer dereference errors in the fprobe_fgraph_entry function. Use commands like dmesg | grep -i "general protection fault" or journalctl -k | grep -i "null-ptr-deref" to search for related errors.

Impact Analysis

This vulnerability can cause a kernel crash (oops) due to a NULL pointer dereference, potentially leading to system instability or denial of service. It may also allow unintended memory access, though exploitation requires specific conditions like a fprobe being registered on an already-active IP address.

Compliance Impact

This vulnerability is a NULL pointer dereference in the Linux kernel's tracing subsystem that could lead to a kernel oops or crash. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel stability.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If no patch is available, consider disabling fprobe or function graph tracer features temporarily until an update is applied.

Hi! I’m here to help you understand CVE-2026-72385. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70