CVE-2026-72385 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
fprobe_fgraph_entry() sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second walk, both under rcu_read_lock() only. A fprobe registered on an already-live ip can become visible between the two walks, so the fill walk processes an exit_handler the sizing walk did not count and used runs past reserved_words. If the sizing walk counted nothing, fgraph_data is NULL and the first write_fprobe_header() faults:
Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:fprobe_fgraph_entry+0xa38/0xf10 kernel/trace/fprobe.c:167 Call Trace: <TASK> function_graph_enter_regs+0x44c/0xa10 kernel/trace/fgraph.c:677 ftrace_graph_func+0xc5/0x140 arch/x86/kernel/ftrace.c:671 __kernel_text_address+0x9/0x40 kernel/extable.c:78 arch_stack_walk+0x117/0x170 arch/x86/kernel/stacktrace.c:26 kmem_cache_free+0x188/0x580 mm/slub.c:6378 tcp_data_queue+0x18d/0x6550 net/ipv4/tcp_input.c:5590 [...]
</TASK>
The list cannot be frozen across the two walks, so skip a node that does not fit the reservation and count it as missed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's tracing subsystem, specifically within the fprobe functionality designed for function graph tracing. This issue manifests as a NULL pointer dereference in the fprobe_fgraph_entry() function which processes shadow-stack reservations during function graph tracing operations. The flaw occurs when the system attempts to handle multiple walks of the per-ip fprobe list under RCU read locks without proper synchronization between these operations. During the first walk, the system calculates the required shadow-stack reservation size by counting active probes, while a second walk populates this reservation with actual probe data. However, the timing window between these two operations allows for race conditions where new probes can become visible in the list after the sizing operation but before the filling operation, leading to miscalculation of reserved memory boundaries.
The operational impact of this vulnerability is severe as it results in a kernel panic through a general protection fault when attempting to access a NULL pointer dereference at address zero. The kernel's stack trace reveals execution flow through function_graph_enter_regs, ftrace_graph_func, and various architectural stack walking functions before ultimately crashing at the fprobe_fgraph_entry function. This represents a critical security flaw that can be exploited to cause denial of service conditions or potentially enable privilege escalation attacks, particularly when tracing operations are actively monitored by malicious processes. The vulnerability directly violates the principle of proper resource management and synchronization in concurrent kernel operations.
The root cause stems from improper handling of dynamic probe registration during atomic operations within the RCU framework. When a fprobe is registered on an already-live instruction pointer, it can become visible between the sizing and filling walks, causing the second walk to process more entries than initially reserved. This creates a memory access violation when trying to write header information to a NULL fgraph_data structure, as demonstrated by the KASAN null-pointer dereference error. The fix implements defensive programming by skipping probe nodes that cannot fit within the pre-calculated reservation rather than attempting to process them and causing a crash. This approach aligns with common security practices for preventing buffer overflows and memory corruption issues in kernel space operations.
This vulnerability maps directly to CWE-476 which describes NULL pointer dereference conditions, and more specifically relates to improper handling of concurrent data structures under RCU locks. From an ATT&CK perspective, this represents a potential privilege escalation vector through kernel exploitation techniques that leverage race conditions in system call tracing mechanisms. The fix demonstrates proper defensive programming principles by implementing bounds checking and graceful degradation rather than allowing catastrophic failures. It also aligns with the principle of least privilege and robust error handling in kernel design, ensuring that tracing subsystem operations do not compromise overall system stability or security. The solution effectively addresses the concurrency issue by preventing the processing of probe entries that exceed pre-calculated reservation boundaries while maintaining the integrity of the tracing infrastructure.
The mitigation strategy involves implementing proper synchronization mechanisms between the sizing and filling walks to prevent race conditions, or adopting a more conservative approach where probe entries are processed with bounds checking to ensure they fit within allocated memory regions. This requires careful consideration of RCU lock semantics and the timing constraints inherent in kernel-level concurrent operations. The fix essentially transforms an exploitable condition into a graceful failure mode that maintains system stability while preserving tracing functionality. Organizations should prioritize applying this kernel patch immediately, as it addresses a critical vulnerability that could be exploited by malicious actors to disrupt system operations or gain elevated privileges within the kernel space environment.