CVE-2026-68174: tracing: Fix union collision of module and refcnt for dynamic events
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix union collision of module and refcnt for dynamic events
In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter.
When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL.
When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'setevent'), the code in 'ftracesetclreventnolock()' and 'updateeventfields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name.
Fix this by ensuring that the 'TRACEEVENTFLDYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure that the TRACE_EVENT_FL_DYNAMIC flag is checked before treating call->module as a valid pointer in the tracing code paths that call __ftrace_set_clr_event_nolock() and update_event_fields() for dynamic events.
Linux kernel tracing (trace_event_call / dynamic events) TRACE_EVENT_FL_DYNAMIC flag check before using call->module = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68174?
CVE-2026-68174 has a risk score of 37, indicating potential moderate impact.
How do I fix CVE-2026-68174?
To resolve CVE-2026-68174, update to the latest version of the Linux kernel where the vulnerability has been patched.
What is CVE-2026-68174 concerning?
CVE-2026-68174 addresses a union collision issue in the Linux kernel's tracing subsystem related to dynamic events.
Which software is affected by CVE-2026-68174?
CVE-2026-68174 affects the Linux kernel.
Can CVE-2026-68174 lead to security risks?
Yes, CVE-2026-68174 may lead to security risks given its potential impact on dynamic events in the kernel.