https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:24:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68174 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tracing: Fix union collision of module and refcnt for dynamic events</p> <p>In &#39;struct trace_event_call&#39;, the &#39;module&#39; pointer and the &#39;refcnt&#39; atomic variable share the same memory space in a union. For dynamic events, the union member is &#39;refcnt&#39;, which acts as an active reference counter.</p> <p>When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its &#39;call-&gt;module&#39; evaluates to a small non-zero integer instead of NULL.</p> <p>When filtering or setting events for a specific module (e.g., writing &#39;:mod:&lt;module&gt;&#39; to &#39;set_event&#39;), the code in &#39;__ftrace_set_clr_event_nolock()&#39; and &#39;update_event_fields()&#39; reads &#39;call-&gt;module&#39; directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a &#39;struct module&#39; pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name.</p> <p>Fix this by ensuring that the &#39;TRACE_EVENT_FL_DYNAMIC&#39; flag is checked before treating &#39;call-&gt;module&#39; as a valid pointer in these code paths.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tracing: Fix union collision of module and refcnt for dynamic events</p> <p>In &#39;struct trace_event_call&#39;, the &#39;module&#39; pointer and the &#39;refcnt&#39; atomic variable share the same memory space in a union. For dynamic events, the union member is &#39;refcnt&#39;, which acts as an active reference counter.</p> <p>When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its &#39;call-&gt;module&#39; evaluates to a small non-zero integer instead of NULL.</p> <p>When filtering or setting events for a specific module (e.g., writing &#39;:mod:&lt;module&gt;&#39; to &#39;set_event&#39;), the code in &#39;__ftrace_set_clr_event_nolock()&#39; and &#39;update_event_fields()&#39; reads &#39;call-&gt;module&#39; directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a &#39;struct module&#39; pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name.</p> <p>Fix this by ensuring that the &#39;TRACE_EVENT_FL_DYNAMIC&#39; flag is checked before treating &#39;call-&gt;module&#39; as a valid pointer in these code paths.</p> https://vulnerability.circl.lu/vuln/cve-2026-68174