UBUNTU-CVE-2026-72385: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobefgraphentry() fprobefgraphentry() sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcureadlock() only. A fprobe registered on an already-live ip can become visible between the two walks, so the fill walk processes an exithandler the sizing walk did not count and used runs past reservedwords. If the sizing walk counted nothing, fgraphdata is NULL and the first writefprobeheader() faults: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:fprobefgraphentry+0xa38/0xf10 kernel/trace/fprobe.c:167 Call Trace: <TASK> functiongraphenterregs+0x44c/0xa10 kernel/trace/fgraph.c:677 ftracegraphfunc+0xc5/0x140 arch/x86/kernel/ftrace.c:671 kerneltextaddress+0x9/0x40 kernel/extable.c:78 archstackwalk+0x117/0x170 arch/x86/kernel/stacktrace.c:26 kmemcachefree+0x188/0x580 mm/slub.c:6378 tcpdataqueue+0x18d/0x6550 net/ipv4/tcpinput.c:5590 [...] </TASK> The list cannot be frozen across the two walks, so skip a node that does not fit the reservation and count it as missed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In fprobe_fgraph_entry(), skip any fprobe node that does not fit the reserved shadow-stack space and count it as missed when the per-IP fprobe list changes between the sizing and filling walks.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed affected packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What runtime condition triggers the failure?
The race requires an fprobe to be registered on an already-live instruction pointer after fprobe_fgraph_entry() sizes its shadow-stack reservation but before it fills that reservation. The two list walks are protected only by rcu_read_lock(), so the list can change between them.
How might an affected system present the issue?
The issue can cause a kernel Oops or general protection fault from a NULL pointer dereference in fprobe_fgraph_entry(). KASAN may report a null-ptr-deref, with a trace involving function_graph_enter_regs and ftrace_graph_func.