Executive brief
The Linux kernel's function probe (fprobe) tracing component can crash when a new probe is registered while tracing is active. The crash occurs because the code reserves memory in one pass but new probes added between the reservation and usage steps exceed the reserved space, causing a null pointer fault. This can cause a kernel panic and system unavailability.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in the fprobe_fgraph_entry() function in kernel/trace/fprobe.c. The function performs a two-pass algorithm: first it walks the fprobe list to calculate the required shadow-stack reservation size, then it fills that reservation in a second walk. Both walks are protected only by rcu_read_lock(), allowing new fprobes to become visible between the two passes. If a fprobe with an exit_handler is registered between walks, the fill pass processes an entry not counted during sizing, potentially writing past the reserved buffer boundaries. If the sizing walk counted zero entries, fgraph_data remains NULL and the first write_fprobe_header() call triggers a fault. The fix adds a bounds check during the fill walk to skip entries that no longer fit within the reserved space, marking them as missed rather than corrupting memory.
Affected products
- Linux Linux kernel 5.6 and later (introduced in commit 4346ba160409)
Timeline
- 2026-08-15: disclosed
- 2026-06-30: patched