CVE-2026-74471tracing: Check return value of __register_event() in trace_module_add_events()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed. Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ae63b31e4d0e2ec09c569306ea46f664508ef717 before 3bf965a2827c44f03294107703e7ba53fbd0a69a; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before 9d6d79744f01eacaf3d5522f4fcd59939581abfd; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before 54b7a358f6399c1242d2fb7f4f96085af34baa5e; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before 22f954f7a8afe975e85517aff41b35defe05144b; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before 000765dcdc3edf128990762790543adc4b868f6c; from ae63b31e4d0e2ec09c569306ea46f664508ef717 before ac8719969e6c3c54e939834df812bc41f25453cf | CNA record |
References
- https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a
- https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd
- https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e
- https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5
- https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b
- https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca
- https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c
- https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.