CVE-2026-74633: tracing: Fix NULL pointer dereference in module event cache removal

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix NULL pointer dereference in module event cache removal

A module-only event filter such as ":mod:foo" is cached with a NULL eventmod->match when foo has not been loaded. If a later write tries to remove a specific match from the same module, removecachemod() passes the NULL cached match to strcmp(), causing a NULL pointer dereference.

The issue can be reproduced from userspace:

echo ':mod:traceeventskunitmissing' > /sys/kernel/tracing/setevent echo '!foobar:mod:traceeventskunitmissing' >> /sys/kernel/tracing/setevent

The second write must be a concatenation (">>") to not include OTRUNC as that would cause ftraceclearevents() to clear the cached modules lines.

The crash was reproduced on x8664 QEMU while KUnit workers contended on the event tracing path:

BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode RIP: 0010:strcmp+0x10/0x30 Call Trace: ftracesetclreventnolock+0x373/0x4a0 ftracesetclrevent+0xf0/0x180 ftraceeventwrite+0xdf/0x110 vfswrite+0xf6/0x440 ksyswrite+0x68/0xe0 dosyscall64+0xf9/0x540 entrySYSCALL64afterhwframe+0x77/0x7f

Check eventmod->match before comparing it, consistent with the existing NULL checks for the cached system and event fields. The mismatched removal continues to return -EINVAL; a broad cached module filter is removed with "!:mod:<module>".