CVE-2026-74477uprobes: Fix NULL pointer dereference in hprobe_expire()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone() path: BUG: kernel NULL pointer dereference, address: 0000000000000018 Oops: 0002 [#1] SMP NOPTI RIP: 0010:hprobe_expire CR2: 0000000000000018 Call Trace: uprobe_copy_process copy_process kernel_clone __x64_sys_clone do_syscall_64 entry_SYSCALL_64_after_hwframe This was found on real hosts on Meta fleet. I've got the impression that this is what is happening: CPU 1 CPU 2 (traced task) ----- ------------------- hit uprobe, prepare_uretprobe(): hprobe LEASED, refcount >= 1 uprobe_unregister() put_uprobe(): refcount -> 0 fork() -> dup_utask() hprobe_expire(hprobe, true) try_get_uprobe() -> NULL get_uprobe(NULL) <-- Oops Only take the extra reference when the uprobe is non-NULL; a NULL means it is gone and is the correct value to return.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from dd1a7567784e2b1f80258be04f57bcfa82c997eb before 3bd35a5e272a1b7a3fb43acad9bdc599281b13fa; from dd1a7567784e2b1f80258be04f57bcfa82c997eb before 06c275a6c0a953ef1d763d11a6891fcc69ae2ac0; from dd1a7567784e2b1f80258be04f57bcfa82c997eb before cc679d7a6303e84d769f2afcde1fc51c51f127cd | CNA record |
References
- https://git.kernel.org/stable/c/3bd35a5e272a1b7a3fb43acad9bdc599281b13fa
- https://git.kernel.org/stable/c/06c275a6c0a953ef1d763d11a6891fcc69ae2ac0
- https://git.kernel.org/stable/c/cc679d7a6303e84d769f2afcde1fc51c51f127cd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.