Executive brief
The Linux kernel's event tracing subsystem can crash when processing module-specific event filters if an unloaded module is referenced. An attacker with local write access to the tracing configuration can trigger a NULL pointer dereference by manipulating trace event filters, causing a kernel panic and service disruption.
Technical details
A NULL pointer dereference occurs in the remove_cache_mod() function in kernel/trace/trace_events.c when handling module-only event filters (e.g., ":mod:foo"). When a module is not loaded, the event_mod->match field is cached as NULL. If a subsequent write attempts to remove a specific event match from that same module, the function passes this NULL pointer directly to strcmp() without checking, causing a crash. The vulnerability is triggered via writing specially crafted filter strings to /sys/kernel/tracing/set_event. The fix is a single-line change to add a NULL check before the strcmp() call: `if (match && (!event_mod->match || strcmp(...)))`. This is a kernel DoS vulnerability requiring local filesystem access.
Affected products
- Linux Linux kernel 5.0 and later (affected by change in commit b355247df104, fixed in 6.11.y and later stable branches)
Timeline
- 2026-08-22: disclosed: CVE-2026-74633 published
- 2026-08-19: patched: Fix merged into stable kernel branches (e.g., linux-6.11.y, linux-6.10.y)
- 2026-08-12: other: Patch submitted by Hui Su