CVE-2026-68174: Linux Kernel Privilege Escalation Flaw

CVE-2026-68174 Overview

CVE-2026-68174 is a NULL pointer dereference vulnerability in the Linux kernel tracing subsystem. The flaw affects the handling of dynamic events such as kprobe, uprobe, fprobe, eprobe, and wprobe. In struct trace_event_call, the module pointer and the refcnt atomic counter share the same memory through a union. When a dynamic event has a non-zero reference count, code paths that filter events by module read call->module without verifying the event type. The kernel then treats the small integer refcnt value as a struct module pointer, triggering an Oops when dereferencing the module name.

Critical Impact
Local users with permission to write to set_event can trigger a kernel Oops, resulting in denial of service on affected Linux kernel builds.

Affected Products

Linux kernel (upstream tracing subsystem)
Stable kernel branches referenced in the fix commits
Distributions shipping the affected trace_events code paths

Discovery Timeline

2026-08-10 - CVE-2026-68174 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68174

Vulnerability Analysis

The defect resides in the Linux kernel trace_events implementation. struct trace_event_call uses a union to overlap two members: a module pointer used by module-registered events, and a refcnt atomic variable used by dynamic events. The design assumes callers know which union member is valid based on event type.

When an administrator writes a filter such as :mod:<module> to set_event, the functions __ftrace_set_clr_event_nolock() and update_event_fields() iterate over all registered events and read call->module unconditionally. For dynamic events with active triggers or perf attachments, refcnt is non-zero. The union storage returns that small integer when read through the module field.

The kernel then dereferences that integer as a pointer to access the module name string. Because the value is a small numeric refcnt rather than a valid kernel address, the resulting memory access faults and produces a kernel Oops. The fix adds a TRACE_EVENT_FL_DYNAMIC flag check before treating call->module as a pointer.

Root Cause

The root cause is missing type discrimination on a union member [CWE-476]. The tracing code does not test TRACE_EVENT_FL_DYNAMIC before reading call->module, so refcnt values are misinterpreted as pointers.

Attack Vector

Exploitation requires local access and the ability to write to tracefs interfaces such as set_event. An attacker with sufficient privileges creates a dynamic event, raises its refcnt through triggers or perf attachment, then issues a module-scoped event filter to trigger the invalid dereference.

// No verified proof-of-concept code is available.
// See the upstream commits referenced below for the exact patched code paths.

Detection Methods for CVE-2026-68174

Indicators of Compromise

Kernel Oops entries in dmesg or /var/log/kern.log referencing __ftrace_set_clr_event_nolock or update_event_fields
Unexpected system panics or reboots on hosts using dynamic tracing tooling
Writes to /sys/kernel/tracing/set_event containing :mod: filters combined with active kprobe or uprobe events

Detection Strategies

Monitor audit logs for write syscalls to tracefs and debugfs event control files by non-root or non-tracing service accounts
Correlate creation of kprobe_events, uprobe_events, or dynamic_events entries with subsequent set_event writes containing module filters
Alert on kernel crash telemetry that names the tracing subsystem functions in the call stack

Monitoring Recommendations

Ingest kernel logs and audit records into a centralized analytics platform for stack-trace correlation
Track running kernel versions across the fleet and flag hosts that have not applied the referenced stable commits
Baseline legitimate tracing activity per host and alert on deviations that involve dynamic event refcnt changes

How to Mitigate CVE-2026-68174

Immediate Actions Required

Apply the stable kernel updates that include the referenced fix commits and reboot affected hosts
Restrict write access to tracefs and debugfs to trusted administrators and required observability agents
Audit and remove unnecessary dynamic events left in place by profiling or debugging sessions

Patch Information

The fix adds a check for TRACE_EVENT_FL_DYNAMIC before treating call->module as a valid pointer. Merge the upstream changes referenced in the following commits: Kernel commit 43a23dfe0024, Kernel commit b4eb07bde606, and Kernel commit b6a4575f2292. Distribution vendors will backport these commits into supported stable branches.

Workarounds

Unmount tracefs or set restrictive permissions where dynamic tracing is not required
Avoid using :mod:<module> event filters on unpatched kernels that also host active kprobes, uprobes, fprobes, eprobes, or wprobes
Remove active event triggers and detach perf sessions from dynamic events before issuing module-scoped set_event commands

bash

# Restrict tracefs access to root on unpatched hosts
mount -o remount,mode=0700 /sys/kernel/tracing
chown root:root /sys/kernel/tracing
chmod 0700 /sys/kernel/tracing