CVE-2026-64451: tracing: Fix NULL pointer dereference in func_set_flag()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix NULL pointer dereference in funcsetflag()
funcsetflag() dereferences tr->currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from "function" (e.g., to "wakeuprt"), tr->currenttraceflags can be NULL, leading to a NULL pointer dereference and kernel crash.
The call chain that triggers this is:
traceoptionswrite() -> settraceroption() -> trace->setflag() / funcsetflag /
In funcsetflag(), the first operation is:
if (!!set == !!(tr->currenttraceflags->val & bit))
This dereferences tr->currenttraceflags unconditionally. The safety check that guards against a non-function tracer:
if (tr->currenttrace != &functiontrace) return 0;
is placed after the dereference, which is too late.
This was observed with the following crash dump:
BUG: unable to handle page fault at 0000000000000000 RIP: funcsetflag+0xd
Call Trace: settraceroption+0x27 traceoptionswrite+0x75 vfswrite+0x12a ksyswrite+0x66 dosyscall64+0x5b
RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202 RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080
The disassembly confirms the fault:
funcsetflag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->currenttraceflags = NULL funcsetflag+13: mov (%rax), %eax ; page fault: dereference NULL
At the time of the crash: tr->currenttraceflags = 0x0 (NULL) tr->currenttrace = wakeuprttracer (not functiontrace)
The scenario is that a process opens a function tracer option file (such as "funcstacktrace"), then the current tracer is switched to another tracer (e.g., "wakeuprt"), which sets currenttraceflags to NULL. When the process subsequently writes to the option file, funcsetflag() is invoked and crashes on the NULL dereference.
Fix this by moving the currenttrace check before the currenttraceflags dereference, so that funcsetflag() returns early when the function tracer is not active.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch tracing: Fix NULL pointer dereference in func_set_flag()
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
A local user or process must be able to write tracing options through the trace options write path. The active tracer must have been changed away from the function tracer, such as to "wakeup_rt", before a function-tracer option is set.
What is the practical impact of successful exploitation?
The unconditional dereference of a NULL current_trace_flags pointer can crash the kernel. The provided CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and an availability impact without confidentiality or integrity impact.
How can administrators determine whether a system has encountered this issue?
Affected systems may log a NULL-page fault with an instruction pointer in func_set_flag. The supplied example includes a call chain through __set_tracer_option(), trace_options_write(), and vfs_write().
What mitigation is indicated if an update cannot be applied immediately?
Avoid changing function-tracer options after switching the active tracer away from "function". This prevents the trace_options_write() path from reaching func_set_flag() with a NULL current_trace_flags pointer.