CVE-2026-74636
Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and, event_define_fields The following sequence may leads race between event_define_fields() and update_event_fields(): CPU0 (loads module A) CPU1 (loads module B) =============================== =============================== load_module(A) load_module(B) notifier_call_chain notifier_call_chain trace_module_notify trace_module_notify mutex_lock(&event_mutex) trace_event_update_all() trace_module_add_events(A) down_write(&trace_event_sem) __register_event(call_A) __add_event_to_tracers(call_A) event_define_fields(call_A) for each f: list_for_each_entry(field, list_add(&f->link, &class->fields, link) &class->fields) field = class->fields->next; Where access to the class->fields is not protected by the event_mutex in trace_event_update_all(). This produces the following panic: Unable to handle kernel access ... at virtual address 0000000000000018 pc : update_event_fields+0xf8/0x368 Call trace: update_event_fields+0xf8/0x368 trace_event_update_all+0x7c/0x2b4 trace_module_notify+0x4c/0x1dc notifier_call_chain+0x84/0x168 blocking_notifier_call_chain_robust+0x64/0xd4 load_module+0x10c8/0x123c __arm64_sys_finit_module+0x230/0x31c Fix by taking event_mutex in trace_event_update_all() before trace_event_sem.
How to fix
- Linux Linux4e39f7b4d9d36508c53e89e6cbc640728df870b5, a30d421468300b1e7b2f233136aeb2db8013f555, e5f1d301b4bdaa4206db251fdc691f623162b0a8, fdeb190b0905a6aaed1e5d6adfb8613214748d7d, ed49684e69f846bf50b5050651ccdb87cfd152c0, f128740f39ab28d1f4ad5bdd10f3e117eec0c374, c3730b8373bb5059d735509b9e6a00d7eb337d7c, 5.15.216, 5.17, 5.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 7c6bd60999f32138e3b73fd97ea11ef47a94de25 ≤ v < 4e39f7b4d9d36508c53e89e6cbc640728df870b5, b3bc8547d3be60898818885f5bf22d0a62e2eb48 ≤ v < a30d421468300b1e7b2f233136aeb2db8013f555, b3bc8547d3be60898818885f5bf22d0a62e2eb48 ≤ v < e5f1d301b4bdaa4206db251fdc691f623162b0a8, b3bc8547d3be60898818885f5bf22d0a62e2eb48 ≤ v < fdeb190b0905a6aaed1e5d6adfb8613214748d7d, b3bc8547d3be60898818885f5bf22d0a62e2eb48 ≤ v < ed49684e69f846bf50b5050651ccdb87cfd152c0, b3bc8547d3be60898818885f5bf22d0a62e2eb48 ≤ v < f128740f39ab28d1f4ad5bdd10f3e117eec0c374, b3bc8547d3be60898818885f5bf22d0a62e2eb48 ≤ v < c3730b8373bb5059d735509b9e6a00d7eb337d7c, 55defdf935fab9f2989a197aae1042c082d9a343, 0c53a5c80e6e286733381a1d9f255ba4039e2e45, 5.15.33 ≤ v < 5.15.216, 5.16.19 ≤ v < 5.17, 5.17.2 ≤ v < 5.18, 5.18 | 4e39f7b4d9d36508c53e89e6cbc640728df870b5, a30d421468300b1e7b2f233136aeb2db8013f555, e5f1d301b4bdaa4206db251fdc691f623162b0a8, fdeb190b0905a6aaed1e5d6adfb8613214748d7d, ed49684e69f846bf50b5050651ccdb87cfd152c0, f128740f39ab28d1f4ad5bdd10f3e117eec0c374, c3730b8373bb5059d735509b9e6a00d7eb337d7c, 5.15.216, 5.17, 5.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.