Executive brief
The Linux kernel's tracing subsystem contains a race condition that can occur when multiple CPU cores simultaneously load kernel modules with tracing events. This bug can cause a kernel panic when the system attempts to access shared data structures without proper synchronization, potentially disrupting system stability and availability.
Technical details
A race condition exists in the kernel's tracing subsystem between the update_event_fields() and event_define_fields() functions. The vulnerability occurs when multiple CPUs simultaneously load kernel modules while trace_event_update_all() iterates over class->fields without holding the event_mutex lock. The event_define_fields() function modifies the same list via list_add() operations while holding only event_mutex, but trace_event_update_all() accesses the list while holding only trace_event_sem. This unsynchronized concurrent access can cause the kernel to panic when dereferencing corrupted or invalid memory pointers. The fix requires acquiring event_mutex in trace_event_update_all() before trace_event_sem to ensure proper mutual exclusion.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed