« Volver al listado

CVE-2026-68174

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix union collision of module and refcnt for dynamic events

In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter.

When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL.

When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic.

Leer descripción completaMostrar menos

This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name.

Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68174",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4c86bc531e60900053384867c082675bba82c29f",
              "lessThan": "b6a4575f22925da7e6aa00171e9fc0e5029c0bc9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4c86bc531e60900053384867c082675bba82c29f",
              "lessThan": "43a23dfe0024afd3d2b0232e987d0292919a9b24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4c86bc531e60900053384867c082675bba82c29f",
              "lessThan": "b4eb07bde606c2096b24252be589e735eff6d413",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:04.213",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/43a23dfe0024afd3d2b0232e987d0292919a9b24",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b4eb07bde606c2096b24252be589e735eff6d413",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b6a4575f22925da7e6aa00171e9fc0e5029c0bc9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix union collision of module and refcnt for dynamic events\n\nIn 'struct trace_event_call', the 'module' pointer and the 'refcnt'\natomic variable share the same memory space in a union. For dynamic\nevents, the union member is 'refcnt', which acts as an active\nreference counter.\n\nWhen a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or\nwprobe) has a non-zero reference count (e.g. due to active event\ntriggers or perf attachments), its 'call->module' evaluates to a\nsmall non-zero integer instead of NULL.\n\nWhen filtering or setting events for a specific module (e.g., writing\n':mod:<module>' to 'set_event'), the code in\n'__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads\n'call->module' directly without checking whether the event is dynamic.\nThis causes the kernel to treat the small integer (refcnt) as a\n'struct module' pointer, leading to a NULL/invalid pointer dereference\n(Oops) when dereferencing the module name.\n\nFix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked\nbefore treating 'call->module' as a valid pointer in these code paths."
    }
  ],
  "lastModified": "2026-08-17T05:18:18.927",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}