CVE-2026-64451 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix NULL pointer dereference in func_set_flag()
func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from "function" (e.g., to "wakeup_rt"), tr->current_trace_flags can be NULL, leading to a NULL pointer dereference and kernel crash.
The call chain that triggers this is:
trace_options_write() -> __set_tracer_option() -> trace->set_flag() /* func_set_flag */
In func_set_flag(), the first operation is:
if (!!set == !!(tr->current_trace_flags->val & bit))
This dereferences tr->current_trace_flags unconditionally. The safety check that guards against a non-function tracer:
if (tr->current_trace != &function_trace) return 0;
is placed *after* the dereference, which is too late.
This was observed with the following crash dump:
BUG: unable to handle page fault at 0000000000000000 RIP: func_set_flag+0xd
Call Trace: __set_tracer_option+0x27 trace_options_write+0x75 vfs_write+0x12a ksys_write+0x66 do_syscall_64+0x5b
RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202 RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080
The disassembly confirms the fault:
func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current_trace_flags = NULL func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL
At the time of the crash: tr->current_trace_flags = 0x0 (NULL) tr->current_trace = wakeup_rt_tracer (not function_trace)
The scenario is that a process opens a function tracer option file (such as "func_stack_trace"), then the current tracer is switched to another tracer (e.g., "wakeup_rt"), which sets current_trace_flags to NULL. When the process subsequently writes to the option file, func_set_flag() is invoked and crashes on the NULL dereference.
Fix this by moving the current_trace check before the current_trace_flags dereference, so that func_set_flag() returns early when the function tracer is not active.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical null pointer dereference in the Linux kernel's tracing subsystem, specifically within the function tracer implementation. This flaw exists in the func_set_flag() function where improper ordering of conditional checks leads to execution of code that attempts to dereference a null pointer. The technical root cause stems from a violation of proper defensive programming practices where the validation check occurs after the pointer access operation. According to CWE-476, this manifests as a NULL pointer dereference vulnerability that can result in system crashes and potential denial of service conditions. The issue aligns with ATT&CK technique T1489 which involves disrupting availability through system resource manipulation.
The operational impact of this vulnerability is significant as it allows for arbitrary kernel crashes when transitioning between different tracer implementations. When a process attempts to write to function tracer option files while the active tracer has been switched away from the function tracer, the kernel experiences an immediate page fault. The crash occurs because the function tracer's flag setting mechanism does not properly validate that it is operating within the correct tracing context before accessing trace flags. This creates a race condition scenario where the system state changes between the initial file access and subsequent write operations, leading to the null pointer dereference at offset 0xd in func_set_flag.
The call chain that triggers this vulnerability begins with trace_options_write() which invokes __set_tracer_option(), ultimately leading to trace->set_flag() being called with func_set_flag() as the specific implementation. The problematic code structure shows that the conditional check for tracer type occurs after the pointer dereference operation, creating an execution path where tr->current_trace_flags is accessed without validation. This ordering error directly violates standard kernel security practices and defensive programming principles. The crash dump analysis confirms that RAX register contains a null value representing tr->current_trace_flags during the fault, with the page fault occurring at the instruction attempting to dereference this null pointer.
The fix implementation requires reordering the conditional logic within func_set_flag() by moving the safety check that verifies the current tracer type before any pointer dereference operations. This ensures that when the active tracer is not the function tracer, the function returns early without attempting to access potentially null trace flags. The solution addresses the fundamental issue of improper validation sequence and aligns with kernel development best practices for preventing null pointer dereferences. This remediation approach prevents unauthorized code execution while maintaining system stability during legitimate tracer transitions, thus preserving the integrity of the kernel's tracing infrastructure and preventing potential exploitation through denial of service attacks.