CVE-2026-74633 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix NULL pointer dereference in module event cache removal
A module-only event filter such as ":mod:foo" is cached with a NULL event_mod->match when foo has not been loaded. If a later write tries to remove a specific match from the same module, remove_cache_mod() passes the NULL cached match to strcmp(), causing a NULL pointer dereference.
The issue can be reproduced from userspace:
echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event echo '!foo_bar:mod:trace_events_kunit_missing' >> /sys/kernel/tracing/set_event
The second write must be a concatenation (">>") to not include O_TRUNC as that would cause ftrace_clear_events() to clear the cached modules lines.
The crash was reproduced on x86_64 QEMU while KUnit workers contended on the event tracing path:
BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode RIP: 0010:strcmp+0x10/0x30 Call Trace: __ftrace_set_clr_event_nolock+0x373/0x4a0 ftrace_set_clr_event+0xf0/0x180 ftrace_event_write+0xdf/0x110 vfs_write+0xf6/0x440 ksys_write+0x68/0xe0 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Check event_mod->match before comparing it, consistent with the existing NULL checks for the cached system and event fields. The mismatched removal continues to return -EINVAL; a broad cached module filter is removed with "!:mod:<module>".
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/23/2026
The Linux kernel's tracing subsystem contains a critical vulnerability involving improper handling of null pointers during the management of module-specific event filters. This flaw manifests when userspace attempts to manipulate trace events using module-only filters, specifically those formatted as ":mod:foo". The underlying technical issue stems from how the kernel caches these filter configurations. When a user writes a command such as echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event for a module that is not currently loaded into the kernel, the system creates a cached entry with a NULL event_mod->match field because there is no active module structure to bind against at that moment. This caching mechanism is designed to optimize subsequent operations on similar filters, but it fails to account for the null state of the match pointer when the referenced module remains unloaded.
The vulnerability triggers during the removal phase of these cached entries. When a user subsequently attempts to remove a specific match from the same module cache by writing a negated filter command like !foo_bar:mod:trace_events_kunit_missing, the kernel invokes the remove_cache_mod() function. This function retrieves the previously stored cached entry and passes its event_mod->match field directly to the strcmp() function for comparison purposes. Because the initial write occurred when the module was absent, this match pointer is NULL. Passing a null pointer to strcmp(), which expects valid memory addresses to perform string comparisons, results in an immediate kernel panic due to a NULL pointer dereference. This specific sequence requires careful reproduction conditions; specifically, the second write operation must use append mode (>>) rather than overwrite mode (>), as overwriting would trigger ftrace_clear_events() and clear the cached module lines before the removal logic is executed, thereby bypassing the vulnerable code path.
The operational impact of this vulnerability is severe, leading to a denial of service through kernel instability or crash. The provided call trace indicates that the fault occurs within strcmp(), triggered by __ftrace_set_clr_event_nolock() and subsequently ftrace_set_clr_event(). This chain originates from user-space write operations via vfs_write and ksys_write, ultimately reaching entry_SYSCALL_64_after_hwframe on x86_64 architectures. In environments where KUnit workers contend for access to the event tracing path, this race condition or timing dependency can be exploited more readily, causing system-wide instability. The crash is characterized by a supervisor read access violation in kernel mode at address 0x0000000000000000, confirming that the CPU attempted to dereference an invalid memory location. This represents a significant risk for systems relying on dynamic tracing for debugging or performance monitoring, as unprivileged users with write access to /sys/kernel/tracing/set_event can crash the entire system.
From a security classification perspective, this vulnerability aligns with CWE-476: NULL Pointer Dereference, which describes errors resulting from dereferencing null pointers that lead to unexpected behavior such as crashes or potential code execution if other conditions are met. In terms of attack vectors and techniques, it relates to the ATT&CK framework's T1059 Command and Scripting Interpreter, specifically through shell commands interacting with kernel interfaces, although the primary impact here is denial of service rather than privilege escalation. The vulnerability highlights a gap in input validation within the ftrace subsystem regarding cached state management for unloaded modules.
The resolution involves modifying the remove_cache_mod() function to check if event_mod->match is NULL before attempting any string comparison operations. This approach ensures consistency with existing null checks already present for cached system and event fields, preventing the kernel from passing invalid pointers to strcmp(). The fix maintains functional integrity by ensuring that mismatched removals still return an -EINVAL error code appropriately, signaling a logical failure rather than crashing the kernel. Furthermore, broad cached module filters can still be removed using the standard syntax !:mod:<module>, preserving intended administrative capabilities while eliminating the crash vector. System administrators and developers should apply this patch to mitigate the risk of local denial-of-service attacks via trace event manipulation.