CVE-2026-74477

Received Received - Intake

NULL pointer dereference in Linux kernel uprobes

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone() path: BUG: kernel NULL pointer dereference, address: 0000000000000018 Oops: 0002 [#1] SMP NOPTI RIP: 0010:hprobe_expire CR2: 0000000000000018 Call Trace: uprobe_copy_process copy_process kernel_clone __x64_sys_clone do_syscall_64 entry_SYSCALL_64_after_hwframe This was found on real hosts on Meta fleet. I've got the impression that this is what is happening: CPU 1 CPU 2 (traced task) ----- ------------------- hit uprobe, prepare_uretprobe(): hprobe LEASED, refcount >= 1 uprobe_unregister() put_uprobe(): refcount -> 0 fork() -> dup_utask() hprobe_expire(hprobe, true) try_get_uprobe() -> NULL get_uprobe(NULL) <-- Oops Only take the extra reference when the uprobe is non-NULL; a NULL means it is gone and is the correct value to return.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74477

EUVD

EUVD-2026-59670

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where forking a task with a pending uretprobe (user-space return probe) causes a NULL pointer dereference in the clone() path. The issue occurs when a uprobe is unregistered while another task is being forked, leading to a race condition that crashes the kernel with a NULL pointer dereference in hprobe_expire().

Detection Guidance

This vulnerability is specific to the Linux kernel and involves a NULL pointer dereference in the uprobe subsystem. Detection requires checking kernel logs for oops messages or NULL pointer dereference errors related to hprobe_expire or uprobe_copy_process. Monitor system logs for kernel crashes or errors during task forking with uretprobes active.

Impact Analysis

This vulnerability can cause kernel crashes (oops) on affected systems, leading to denial-of-service conditions. Systems running Linux kernels with uretprobes enabled may experience unexpected reboots or system instability when specific conditions are met during task forking.

Compliance Impact

This vulnerability is a kernel-level NULL pointer dereference in the Linux uprobes subsystem, causing system crashes (oops) during task forking with pending uretprobes. It does not directly relate to data privacy, access controls, or audit logging required by GDPR or HIPAA. Compliance impact would only occur if system crashes lead to data unavailability or corruption, which is not specified in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, avoid using uretprobes or disable the affected functionality until an update is applied. Monitor kernel logs for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-74477. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70