CVE-2026-74471
Received Received - Intake

Use-After-Free in Linux Kernel Tracing Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed. Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74471
EUVD
EUVD-2026-59664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's tracing subsystem. It occurs when a module fails to load properly but leaves behind stale tracing state. Specifically, if event registration fails during module loading, the kernel does not clean up the trace_event_call structure, which can later be accessed by the tracing subsystem, causing a use-after-free when operations are performed on it.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and may not have direct network detection methods. System administrators should check kernel logs for trace subsystem errors or crashes using commands like dmesg | grep trace or journalctl -k | grep trace. Kernel oops or panic logs may indicate exploitation.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. An attacker with local access could trigger the use-after-free to execute arbitrary code in the kernel context, potentially gaining full control over the system.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-74471. Avoid loading untrusted kernel modules. Monitor kernel logs for trace-related errors. If custom modules are used, review their event registration logic to ensure proper error handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart