CVE-2026-64451
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix NULL pointer dereference in func_set_flag()
func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from "function" (e.g., to "wakeup_rt"), tr->current_trace_flags can be NULL, leading to a NULL pointer dereference and kernel crash.
The call chain that triggers this is:
In func_set_flag(), the first operation is:
This dereferences tr->current_trace_flags unconditionally. The safety check that guards against a non-function tracer:
Leer descripción completaMostrar menos
is placed *after* the dereference, which is too late.
This was observed with the following crash dump:
The disassembly confirms the fault:
The scenario is that a process opens a function tracer option file (such as "func_stack_trace"), then the current tracer is switched to another tracer (e.g., "wakeup_rt"), which sets current_trace_flags to NULL. When the process subsequently writes to the option file, func_set_flag() is invoked and crashes on the NULL dereference.
Fix this by moving the current_trace check before the current_trace_flags dereference, so that func_set_flag() returns early when the function tracer is not active.
Detalles técnicos trazas, registros y código del informe original
trace_options_write()
-> __set_tracer_option()
-> trace->set_flag() /* func_set_flag */
if (!!set == !!(tr->current_trace_flags->val & bit))
if (tr->current_trace != &function_trace)
return 0;
BUG: unable to handle page fault at 0000000000000000
RIP: func_set_flag+0xd
Call Trace:
__set_tracer_option+0x27
trace_options_write+0x75
vfs_write+0x12a
ksys_write+0x66
do_syscall_64+0x5b
RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202
RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080
func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current_trace_flags = NULL
func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL
At the time of the crash:
tr->current_trace_flags = 0x0 (NULL)
tr->current_trace = wakeup_rt_tracer (not function_trace)CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.14%
- Percentil entre todas las CVEs puntuadas: 3
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-64451",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "76680d0d2825900f23bf35290ab2b80bdf3a8e4a",
"lessThan": "69f17ac132a38974cf1defb480cef6b79d1ab768",
"versionType": "git"
},
{
"status": "affected",
"version": "76680d0d2825900f23bf35290ab2b80bdf3a8e4a",
"lessThan": "c3e94604675e3db186111b8942650d86577df9b0",
"versionType": "git"
}
],
"programFiles": [
"kernel/trace/trace_functions.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/trace/trace_functions.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-25T10:17:30.013",
"references": [
{
"url": "https://git.kernel.org/stable/c/69f17ac132a38974cf1defb480cef6b79d1ab768",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3e94604675e3db186111b8942650d86577df9b0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix NULL pointer dereference in func_set_flag()\n\nfunc_set_flag() dereferences tr->current_trace_flags before verifying\nthat the current tracer is actually the function tracer. When the active\ntracer has been switched away from \"function\" (e.g., to \"wakeup_rt\"),\ntr->current_trace_flags can be NULL, leading to a NULL pointer\ndereference and kernel crash.\n\nThe call chain that triggers this is:\n\n trace_options_write()\n -> __set_tracer_option()\n -> trace->set_flag() /* func_set_flag */\n\nIn func_set_flag(), the first operation is:\n\n if (!!set == !!(tr->current_trace_flags->val & bit))\n\nThis dereferences tr->current_trace_flags unconditionally. The safety\ncheck that guards against a non-function tracer:\n\n if (tr->current_trace != &function_trace)\n return 0;\n\nis placed *after* the dereference, which is too late.\n\nThis was observed with the following crash dump:\n\n BUG: unable to handle page fault at 0000000000000000\n RIP: func_set_flag+0xd\n\n Call Trace:\n __set_tracer_option+0x27\n trace_options_write+0x75\n vfs_write+0x12a\n ksys_write+0x66\n do_syscall_64+0x5b\n\n RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202\n RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001\n RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080\n\nThe disassembly confirms the fault:\n\n func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current_trace_flags = NULL\n func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL\n\nAt the time of the crash:\n tr->current_trace_flags = 0x0 (NULL)\n tr->current_trace = wakeup_rt_tracer (not function_trace)\n\nThe scenario is that a process opens a function tracer option file (such\nas \"func_stack_trace\"), then the current tracer is switched to another\ntracer (e.g., \"wakeup_rt\"), which sets current_trace_flags to NULL. When\nthe process subsequently writes to the option file, func_set_flag() is\ninvoked and crashes on the NULL dereference.\n\nFix this by moving the current_trace check before the\ncurrent_trace_flags dereference, so that func_set_flag() returns early\nwhen the function tracer is not active."
}
],
"lastModified": "2026-09-03T15:29:27.130",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}