CVE-2026-68174

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix union collision of module and refcnt for dynamic events

In 'struct trace_event_call', the 'module' pointer and the 'refcnt'

atomic variable share the same memory space in a union. For dynamic

events, the union member is 'refcnt', which acts as an active

reference counter.

When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or

wprobe) has a non-zero reference count (e.g. due to active event

triggers or perf attachments), its 'call->module' evaluates to a

small non-zero integer instead of NULL.

When filtering or setting events for a specific module (e.g., writing

':mod:<module>' to 'set_event'), the code in

'__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads

'call->module' directly without checking whether the event is dynamic.

This causes the kernel to treat the small integer (refcnt) as a

'struct module' pointer, leading to a NULL/invalid pointer dereference

(Oops) when derefe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References