Executive brief
A vulnerability in the Linux kernel's tracing component can cause a system crash. This occurs when a user interacts with specific diagnostic settings while the system's internal tracing mode is being changed. An exploit would result in a complete denial of service, requiring a system reboot and potentially disrupting ongoing operations.
Technical details
A NULL pointer dereference exists in kernel/trace/trace_functions.c within the func_set_flag() function. The vulnerability is caused by dereferencing 'tr->current_trace_flags' before validating that the active tracer is the 'function' tracer. If a process opens a function tracer option file (e.g., 'func_stack_trace') and the tracer is subsequently switched to another type (like 'wakeup_rt'), 'current_trace_flags' becomes NULL. A subsequent write to the option file triggers the dereference. This can be exploited by a local user with permissions to write to trace option files to cause a kernel panic. The fix involves reordering the safety check to occur before the pointer dereference.
Affected products
- Linux Linux Kernel 76680d0d2825 to 69f17ac132a38974cf1defb480cef6b79d1ab768
Timeline
- 2026-06-24: disclosed: Initial patch submission by Yuanhe Shu
- 2026-07-18: patched: Committed to stable tree by Greg Kroah-Hartman
- 2026-07-25: advisory: NVD publication date