CVE-2026-68174 (GCVE-0-2026-68174)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-17 05:00
VLAI
Title
tracing: Fix union collision of module and refcnt for dynamic events
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4c86bc531e60900053384867c082675bba82c29f , < b6a4575f22925da7e6aa00171e9fc0e5029c0bc9 (git)
Affected: 4c86bc531e60900053384867c082675bba82c29f , < 43a23dfe0024afd3d2b0232e987d0292919a9b24 (git)
Affected: 4c86bc531e60900053384867c082675bba82c29f , < b4eb07bde606c2096b24252be589e735eff6d413 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6a4575f22925da7e6aa00171e9fc0e5029c0bc9",
              "status": "affected",
              "version": "4c86bc531e60900053384867c082675bba82c29f",
              "versionType": "git"
            },
            {
              "lessThan": "43a23dfe0024afd3d2b0232e987d0292919a9b24",
              "status": "affected",
              "version": "4c86bc531e60900053384867c082675bba82c29f",
              "versionType": "git"
            },
            {
              "lessThan": "b4eb07bde606c2096b24252be589e735eff6d413",
              "status": "affected",
              "version": "4c86bc531e60900053384867c082675bba82c29f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix union collision of module and refcnt for dynamic events\n\nIn \u0027struct trace_event_call\u0027, the \u0027module\u0027 pointer and the \u0027refcnt\u0027\natomic variable share the same memory space in a union. For dynamic\nevents, the union member is \u0027refcnt\u0027, which acts as an active\nreference counter.\n\nWhen a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or\nwprobe) has a non-zero reference count (e.g. due to active event\ntriggers or perf attachments), its \u0027call-\u003emodule\u0027 evaluates to a\nsmall non-zero integer instead of NULL.\n\nWhen filtering or setting events for a specific module (e.g., writing\n\u0027:mod:\u003cmodule\u003e\u0027 to \u0027set_event\u0027), the code in\n\u0027__ftrace_set_clr_event_nolock()\u0027 and \u0027update_event_fields()\u0027 reads\n\u0027call-\u003emodule\u0027 directly without checking whether the event is dynamic.\nThis causes the kernel to treat the small integer (refcnt) as a\n\u0027struct module\u0027 pointer, leading to a NULL/invalid pointer dereference\n(Oops) when dereferencing the module name.\n\nFix this by ensuring that the \u0027TRACE_EVENT_FL_DYNAMIC\u0027 flag is checked\nbefore treating \u0027call-\u003emodule\u0027 as a valid pointer in these code paths."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:00:15.155Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6a4575f22925da7e6aa00171e9fc0e5029c0bc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/43a23dfe0024afd3d2b0232e987d0292919a9b24"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4eb07bde606c2096b24252be589e735eff6d413"
        }
      ],
      "title": "tracing: Fix union collision of module and refcnt for dynamic events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68174",
    "datePublished": "2026-08-10T11:59:44.417Z",
    "dateReserved": "2026-07-30T09:28:09.372Z",
    "dateUpdated": "2026-08-17T05:00:15.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68174",
      "date": "2026-09-20",
      "epss": "0.00198",
      "percentile": "0.09882"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/trace_events.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b6a4575f22925da7e6aa00171e9fc0e5029c0bc9",
                    "status": "affected",
                    "version": "4c86bc531e60900053384867c082675bba82c29f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "43a23dfe0024afd3d2b0232e987d0292919a9b24",
                    "status": "affected",
                    "version": "4c86bc531e60900053384867c082675bba82c29f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b4eb07bde606c2096b24252be589e735eff6d413",
                    "status": "affected",
                    "version": "4c86bc531e60900053384867c082675bba82c29f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/trace_events.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix union collision of module and refcnt for dynamic events\n\nIn \u0027struct trace_event_call\u0027, the \u0027module\u0027 pointer and the \u0027refcnt\u0027\natomic variable share the same memory space in a union. For dynamic\nevents, the union member is \u0027refcnt\u0027, which acts as an active\nreference counter.\n\nWhen a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or\nwprobe) has a non-zero reference count (e.g. due to active event\ntriggers or perf attachments), its \u0027call-\u003emodule\u0027 evaluates to a\nsmall non-zero integer instead of NULL.\n\nWhen filtering or setting events for a specific module (e.g., writing\n\u0027:mod:\u003cmodule\u003e\u0027 to \u0027set_event\u0027), the code in\n\u0027__ftrace_set_clr_event_nolock()\u0027 and \u0027update_event_fields()\u0027 reads\n\u0027call-\u003emodule\u0027 directly without checking whether the event is dynamic.\nThis causes the kernel to treat the small integer (refcnt) as a\n\u0027struct module\u0027 pointer, leading to a NULL/invalid pointer dereference\n(Oops) when dereferencing the module name.\n\nFix this by ensuring that the \u0027TRACE_EVENT_FL_DYNAMIC\u0027 flag is checked\nbefore treating \u0027call-\u003emodule\u0027 as a valid pointer in these code paths."
          }
        ],
        "id": "CVE-2026-68174",
        "lastModified": "2026-08-17T05:18:18.927",
        "metrics": {},
        "published": "2026-08-10T13:20:04.213",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/43a23dfe0024afd3d2b0232e987d0292919a9b24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b4eb07bde606c2096b24252be589e735eff6d413"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6a4575f22925da7e6aa00171e9fc0e5029c0bc9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-31T11:44:28+00:00",
      "cve": "CVE-2026-68174",
      "id": "CVE-2026-68174",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing: Fix union collision of module and refcnt for dynamic events",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68174.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:40:10Z",
      "cve": "CVE-2026-68174",
      "id": "CVE-2026-68174",
      "initial_release_date": "2026-08-13T16:23:40Z",
      "product_status:known_affected": "370",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68174",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68174.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.