CVE-2026-68174

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In struct trace event call, the module pointer and the refcnt atomic variable share the same memory space within a union. For dynamic events—including kprobe, uprobe, fprobe, eprobe, or wprobe—the union uses refcnt as an active reference counter. If a dynamic event has a non-zero reference count, call->module returns a small non-zero integer instead of NULL. The functions ftrace set clr event nolock() and update event fields() read call->module directly without verifying if the event is dynamic. This leads the kernel to interpret the refcnt integer as a struct module pointer, resulting in a NULL or invalid pointer dereference (Oops) when the module name is accessed. This occurs specifically when filtering or setting events for a module via the set event interface using the :mod:<module> syntax.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.