CVE-2026-74633

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix NULL pointer dereference in module event cache removal

A module-only event filter such as ":mod:foo" is cached with a NULL

event_mod->match when foo has not been loaded. If a later write tries to

remove a specific match from the same module, remove_cache_mod() passes

the NULL cached match to strcmp(), causing a NULL pointer dereference.

The issue can be reproduced from userspace:

echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event

echo '!foo_bar:mod:trace_events_kunit_missing' >> /sys/kernel/tracing/set_event

The second write must be a concatenation (">>") to not include O_TRUNC as

that would cause ftrace_clear_events() to clear the cached modules lines.

The crash was reproduced on x86_64 QEMU while KUnit workers contended on

the event tracing path:

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

RIP: 0010:strcmp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References