GHSA-C2F7-RHW7-9M5R
Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-10 15:33In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix union collision of module and refcnt for dynamic events
In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter.
When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL.
When filtering or setting events for a specific module (e.g., writing ':mod:' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name.
Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.
{
"affected": [],
"aliases": [
"CVE-2026-68174"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T13:20:04Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix union collision of module and refcnt for dynamic events\n\nIn \u0027struct trace_event_call\u0027, the \u0027module\u0027 pointer and the \u0027refcnt\u0027\natomic variable share the same memory space in a union. For dynamic\nevents, the union member is \u0027refcnt\u0027, which acts as an active\nreference counter.\n\nWhen a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or\nwprobe) has a non-zero reference count (e.g. due to active event\ntriggers or perf attachments), its \u0027call-\u003emodule\u0027 evaluates to a\nsmall non-zero integer instead of NULL.\n\nWhen filtering or setting events for a specific module (e.g., writing\n\u0027:mod:\u003cmodule\u003e\u0027 to \u0027set_event\u0027), the code in\n\u0027__ftrace_set_clr_event_nolock()\u0027 and \u0027update_event_fields()\u0027 reads\n\u0027call-\u003emodule\u0027 directly without checking whether the event is dynamic.\nThis causes the kernel to treat the small integer (refcnt) as a\n\u0027struct module\u0027 pointer, leading to a NULL/invalid pointer dereference\n(Oops) when dereferencing the module name.\n\nFix this by ensuring that the \u0027TRACE_EVENT_FL_DYNAMIC\u0027 flag is checked\nbefore treating \u0027call-\u003emodule\u0027 as a valid pointer in these code paths.",
"id": "GHSA-c2f7-rhw7-9m5r",
"modified": "2026-08-10T15:33:39Z",
"published": "2026-08-10T15:33:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68174"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/43a23dfe0024afd3d2b0232e987d0292919a9b24"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b4eb07bde606c2096b24252be589e735eff6d413"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6a4575f22925da7e6aa00171e9fc0e5029c0bc9"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.