CVE-2026-64451 Overview
CVE-2026-64451 is a NULL pointer dereference vulnerability in the Linux kernel's tracing subsystem. The flaw resides in func_set_flag(), which dereferences tr->current_trace_flags before verifying that the active tracer is the function tracer. When the current tracer has been switched away from function to another tracer such as wakeup_rt, tr->current_trace_flags can be NULL. Writing to a function tracer option file after such a switch triggers a kernel crash. The issue has been resolved upstream by reordering the safety check to occur before the pointer dereference.
Critical Impact
A local user with access to tracing option files under tracefs can trigger a kernel NULL pointer dereference, causing a denial of service via kernel panic.
Affected Products
- Linux kernel (tracing subsystem, func_set_flag() in the function tracer)
- Distributions shipping affected upstream kernel versions prior to the referenced stable commits
- Systems with tracefs accessible to privileged users
Discovery Timeline
- 2026-07-25 - CVE-2026-64451 published to the National Vulnerability Database
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64451
Vulnerability Analysis
The vulnerability is a classic ordering bug in defensive programming. The function func_set_flag() is invoked through the tracing option write path when a user writes to a function-tracer-specific option file such as func_stack_trace. The call chain is trace_options_write() → __set_tracer_option() → trace->set_flag(), which resolves to func_set_flag().
Inside func_set_flag(), the first executed statement compares the requested flag value against the current flag state using the expression if (!!set == !!(tr->current_trace_flags->val & bit)). This dereferences tr->current_trace_flags unconditionally. The subsequent guard if (tr->current_trace != &function_trace) return 0; intended to short-circuit non-function tracers is placed after the dereference, so it never protects the access.
The crash reproducer opens a function tracer option file, switches the active tracer to wakeup_rt (which resets current_trace_flags to NULL), and then writes to the still-open option file. The resulting page fault at func_set_flag+0xd panics the kernel.
Root Cause
The root cause is incorrect ordering of a NULL safety check relative to a pointer dereference [CWE-476]. The tracer identity check must gate access to tr->current_trace_flags, but the original implementation performs the check after the pointer has already been read.
Attack Vector
Exploitation requires local access with permission to open and write to files under tracefs, typically /sys/kernel/tracing/options/ or the per-tracer option files. An attacker holding a file descriptor to a function tracer option file races or waits for the active tracer to be switched, then writes to the option file to trigger the NULL dereference and crash the kernel. The impact is denial of service; no memory corruption or code execution primitive is described in the fix.
No verified public exploit code is available. See the upstream fix at kernel.org commit 69f17ac1 and the companion stable backport c3e94604 for the exact source-level change.
Detection Methods for CVE-2026-64451
Indicators of Compromise
- Kernel oops or panic messages referencing func_set_flag+0xd in the instruction pointer
- BUG: unable to handle page fault at 0000000000000000 entries in dmesg or /var/log/kern.log with a call trace including __set_tracer_option and trace_options_write
- Unexpected reboots on hosts where non-privileged or automation users interact with tracefs
Detection Strategies
- Monitor kernel logs for page fault signatures matching the func_set_flag symbol and the trace_options_write → vfs_write → ksys_write call chain
- Audit access to /sys/kernel/tracing/options/ and per-tracer option files, correlating writes with prior current_tracer changes
- Track running kernel versions across the fleet and flag hosts on unpatched kernels that also expose tracefs to non-root service accounts
Monitoring Recommendations
- Forward kernel.emerg and kernel.alert syslog facilities to a centralized log platform for panic and oops detection
- Enable kdump or equivalent crash-capture tooling so the faulting RIP and register state are preserved for triage
- Alert on tracer-switch events immediately followed by writes to function-tracer option file descriptors held across the switch
How to Mitigate CVE-2026-64451
Immediate Actions Required
- Apply the upstream kernel patch or a distribution kernel update that incorporates commits 69f17ac1 and c3e94604
- Restrict tracefs access to root only by tightening mount options and directory permissions on /sys/kernel/tracing
- Audit any monitoring, profiling, or observability agents that hold long-lived file descriptors on tracer option files and update them to reopen after tracer changes
Patch Information
The fix moves the tr->current_trace != &function_trace check ahead of the tr->current_trace_flags dereference so func_set_flag() returns early when the active tracer is not the function tracer. The change is available in the upstream stable tree at commit 69f17ac1 and commit c3e94604. Rebuild or install a distribution kernel that includes these commits and reboot affected systems.
Workarounds
- Unmount or restrict tracefs where kernel tracing is not required in production
- Set CAP_SYS_ADMIN as the enforcement boundary and remove tracing capabilities from non-administrative service accounts
- Avoid switching the active tracer while other processes hold open handles to function-tracer option files
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
