CVE-2026-74636

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix race between update_event_fields and, event_define_fields

The following sequence may leads race between event_define_fields()

and update_event_fields():

CPU0 (loads module A) CPU1 (loads module B)

=============================== ===============================

load_module(A) load_module(B)

notifier_call_chain notifier_call_chain

trace_module_notify trace_module_notify

mutex_lock(&event_mutex) trace_event_update_all()

trace_module_add_events(A) down_write(&trace_event_sem)

__register_event(call_A)

__add_event_to_tracers(call_A)

event_define_fields(call_A)

for each f: list_for_each_entry(field,

list_add(&f->link,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References