CVE-2026-64451

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix NULL pointer dereference in func_set_flag()

func_set_flag() dereferences tr->current_trace_flags before verifying

that the current tracer is actually the function tracer. When the active

tracer has been switched away from "function" (e.g., to "wakeup_rt"),

tr->current_trace_flags can be NULL, leading to a NULL pointer

dereference and kernel crash.

The call chain that triggers this is:

trace_options_write()

-> __set_tracer_option()

-> trace->set_flag() /* func_set_flag */

In func_set_flag(), the first operation is:

if (!!set == !!(tr->current_trace_flags->val & bit))

This dereferences tr->current_trace_flags unconditionally. The safety

check that guards against a non-function tracer:

if (tr->current_trace != &function_trace)

return 0;

is placed *after* the dereference, which is too late.

This was observed with the following crash dump:

BUG: unable to handle page f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References