Linux Kernel up to 7.1.5/7.2-rc4 tracing trace_event_put_ref use after free

Summaryinfo

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.1.5/7.2-rc4. This impacts the function trace_event_put_ref of the component tracing. The manipulation results in use after free. This vulnerability was named CVE-2026-68177. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.5/7.2-rc4. It has been classified as very critical. Affected is the function trace_event_put_ref of the component tracing. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enable_event" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enable_event data is put into the private_data_free() callback, but the put of the module refcount is done immediately. It is possible that if a module is removed that has an event that would enable (or disable) it is still active, it can read the data of the module after it is removed causing a use-after-free bug. Move the trace_event_put_ref() that releases the module into the delayed callback so that the module can not be removed until any reference to its events are finished.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-68177 since 07/30/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 08/10/2026).

Upgrading to version 7.1.6 or 7.2-rc5 eliminates this vulnerability. Applying the patch 159fdc3e01dca5fdbc412fcd8b239895733a270d/e091351b38818ef620d27f44f4bfd625f13afbff is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion