CVE-2026-98076
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing/probes: Fix use-after-free on field name/type of events with multiple probes
The fields of a probe-based dynamic event (kprobe, uprobe, eprobe and fprobe events) are created in traceprobe_define_arg_fields() by handing the probe_arg name/type strings to trace_define_field(), which only stores the pointers without copying. Those strings are owned by the trace_probe and are freed when that probe is removed.
An event can have several probes attached. The field list is defined only once, by the first probe that registers the event, but it is kept alive by any surviving sibling probe. Deleting just that first probe by symbol -
# primary A: fields are defined from A's args echo 'p:kprobes/ev vfs_read a1=$arg1' > kprobe_events # append B: shares A's event call echo 'p:kprobes/ev vfs_write a1=$arg1' >> kprobe_events # delete only A (matched by symbol), B survives echo '-:kprobes/ev vfs_read' >> kprobe_events
frees A's args (trace_probe_cleanup() -> traceprobe_free_probe_arg()), but trace_probe_unlink() keeps the trace_probe_event because the probe list is not empty. The event call stays registered via B while its fields now reference freed memory. Any field lookup then reads it, e.g.
echo 'a1 == 1' > events/kprobes/ev/filter
BUG: KASAN: slab-use-after-free in strcmp+0xa7/0xb0 Call Trace: strcmp trace_find_event_field parse_pred process_preds create_filter apply_event_filter event_filter_write
field->name references parg->name (kstrdup'd, freed with the probe) and, for array arguments, field->type references parg->fmt (kmalloc'd, freed with the probe) - the scalar type otherwise points at the static fmttype rodata, which is safe.
Have traceprobe_define_arg_fields() duplicate the name and type strings and anchor the copies on the trace_probe_event, which embeds the event call and outlives every individual probe; trace_probe_event_free() releases them.
The reproducer above triggers reliably; the field lookup and the delete both run under event_mutex, so this is a dangling reference after removal rather than a race.
The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
This vulnerability represents a critical use-after-free flaw within the Linux kernel's tracing subsystem, specifically affecting probe-based dynamic events such as kprobes, uprobes, eprobes, and fprobes. The root cause lies in how field metadata is managed during the lifecycle of these probes. When a traceprobe defines argument fields via the function traceprobe_define_arg_fields(), it passes pointers to name and type strings directly into trace_define_field(). Crucially, this process does not create copies of these strings; instead, it stores direct references that point back to memory owned by the individual trace_probe structure. This design assumes that the field data will remain valid as long as any probe associated with the event exists, but fails to account for scenarios where probes are removed individually while others persist.
The operational impact becomes apparent when an event has multiple probes attached and one of them is deleted. In a typical scenario, the first probe registers the event and defines its fields using its own argument strings. Subsequent probes attach to this existing event without redefining the field structure, relying on the shared state. However, when the initial probe is removed via standard deletion commands, it triggers traceprobe_free_probe_arg(), which frees the memory containing the name and type strings associated with that specific probe instance. Despite this deallocation, the underlying trace_probe_event remains active because other sibling probes are still attached to the event call. Consequently, the field structures continue to hold dangling pointers to now-freed kernel slab memory.
This architectural flaw leads to severe security implications when users interact with the filtered events interface. Any operation that requires looking up a field by name or type will dereference these invalid pointers. For instance, writing a filter expression such as 'a1 == 1' into the event's filter file triggers strcmp operations on the corrupted memory. This results in kernel crashes reported as KASAN slab-use-after-free errors and potentially allows for arbitrary code execution if an attacker can control the contents of the freed memory region to manipulate program flow or leak sensitive information. The vulnerability is particularly dangerous because it does not require complex race conditions; since field lookups and probe deletions are serialized under event_mutex, this is a deterministic dangling reference issue rather than a timing-based exploit, making it highly reproducible by local users with appropriate permissions.
From an industry standards perspective, this flaw maps directly to CWE-416: Use After Free, where memory that has been freed is accessed without proper validation of its validity status. In the context of the MITRE ATT&CK framework for enterprise security, this vulnerability facilitates lateral movement and privilege escalation within a compromised system by allowing an unprivileged user or a malicious container workload to crash the host kernel (Denial of Service) or potentially escalate privileges through memory corruption techniques. The issue was identified using automated fuzzing tools at Tencent Yunding Lab, highlighting the importance of dynamic analysis in uncovering deep-seated logic errors in complex subsystems like the Linux tracing infrastructure.
The resolution involves modifying traceprobe_define_arg_fields() to duplicate the name and type strings rather than storing raw pointers. These duplicated strings are then anchored to the trace_probe_event structure, which embeds the event call and is designed to outlive any individual probe instance. This ensures that the field metadata remains valid for as long as the event itself exists, regardless of how many probes have been added or removed. The memory management logic in trace_probe_event_free() has also been updated to properly release these duplicated strings when the entire event is finally destroyed. This fix eliminates the dangling reference by decoupling the lifetime of field metadata from that of individual probe instances, thereby restoring integrity to the tracing subsystem and preventing both system instability and potential exploitation vectors associated with kernel memory corruption.