CVE-2026-74633 Overview
CVE-2026-74633 is a NULL pointer dereference vulnerability in the Linux kernel's tracing subsystem. The flaw resides in the module event cache removal logic within remove_cache_mod(). When a user configures a module-only event filter such as :mod:foo before the target module is loaded, the kernel caches the entry with a NULL event_mod->match field. A subsequent write attempting to remove a specific match from the same module passes the NULL cached value to strcmp(), triggering a kernel-mode NULL pointer dereference and crash.
Critical Impact
Local users with write access to /sys/kernel/tracing/set_event can trigger a kernel crash, resulting in denial of service.
Affected Products
- Linux kernel (upstream tracing subsystem)
- Stable kernel branches referenced in the fix commits
- Distributions shipping the affected tracing code prior to the patch
Discovery Timeline
- 2026-08-22 - CVE-2026-74633 published to NVD
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74633
Vulnerability Analysis
The vulnerability affects the Linux kernel's ftrace event filtering path. Writing :mod:<module> to /sys/kernel/tracing/set_event registers a broad, module-scoped filter. If the referenced module has not yet been loaded, the kernel caches the entry with event_mod->match set to NULL because no specific event name was supplied.
A later append operation (using >> to avoid O_TRUNC clearing the cache) that attempts to remove a specific event match from the same module invokes remove_cache_mod(). That function compares the incoming match string against the cached value using strcmp() without first validating that the cached pointer is non-NULL. The dereference occurs at kernel privilege, panicking the CPU.
The reported crash was reproduced on x86_64 under QEMU with concurrent KUnit workers exercising the event tracing path. The faulting instruction is strcmp+0x10/0x30, invoked from __ftrace_set_clr_event_nolock() via ftrace_event_write() and vfs_write().
Root Cause
The root cause is missing NULL validation on event_mod->match inside remove_cache_mod(). The surrounding code already performs NULL checks for the cached system and event fields, but the module match field was omitted. Cached module-only filters legitimately store NULL in this field, so the removal path must handle that state.
Attack Vector
Exploitation requires local access and write permission to /sys/kernel/tracing/set_event, which is typically restricted to root or CAP_SYS_ADMIN. The proof-of-concept sequence is:
- Write :mod:<unloaded_module> to /sys/kernel/tracing/set_event to seed a NULL-match cache entry.
- Append !<event>:mod:<same_module> using >> so the write does not include O_TRUNC.
- remove_cache_mod() calls strcmp(NULL, ...), panicking the kernel.
The issue is a reliability and denial-of-service defect [CWE-476]. No arbitrary code execution or information disclosure has been reported.
See the upstream fix in Kernel Git Commit 152a004, Kernel Git Commit ad4e9dd, and Kernel Git Commit b698592 for the corrective NULL check.
Detection Methods for CVE-2026-74633
Indicators of Compromise
- Kernel panic logs containing BUG: kernel NULL pointer dereference with RIP: strcmp+0x10/0x30 in the call trace.
- Call stacks showing __ftrace_set_clr_event_nolock → ftrace_set_clr_event → ftrace_event_write immediately before the fault.
- Unexpected host reboots correlated with recent writes to /sys/kernel/tracing/set_event.
Detection Strategies
- Audit access to /sys/kernel/tracing/set_event using auditd file watches to flag write operations, especially those containing :mod: prefixes.
- Parse dmesg and journal output for the signature stack trace above and alert on matches.
- Correlate module load events with prior tracing filter writes to identify the reproduction pattern.
Monitoring Recommendations
- Forward kernel crash dumps and kdump artifacts to a central log store for pattern matching.
- Track processes invoking write() against tracing sysfs paths and baseline expected administrative use.
- Alert on unexpected kernel oops or panic events on production Linux hosts.
How to Mitigate CVE-2026-74633
Immediate Actions Required
- Apply the upstream stable kernel patches referenced below and reboot affected hosts.
- Restrict write access to /sys/kernel/tracing/ to trusted administrators only.
- Review configuration management scripts that populate set_event for use of :mod: filters against unloaded modules.
Patch Information
The fix adds a NULL check on event_mod->match before invoking strcmp(), aligning behavior with the existing NULL guards for the cached system and event fields. Mismatched removals continue to return -EINVAL, and a broad cached module filter can still be cleared with !:mod:<module>. The patches are available in the following upstream commits: Kernel Git Commit 152a004, Kernel Git Commit ad4e9dd, and Kernel Git Commit b698592.
Workarounds
- Remove or tighten permissions on /sys/kernel/tracing/set_event so unprivileged automation cannot write to it.
- Avoid seeding module-only filters (:mod:<module>) for modules that are not currently loaded.
- When clearing cached module filters, use the broad form !:mod:<module> rather than a specific event match until the patch is deployed.
# Verify running kernel and confirm patched commit is present
uname -r
zcat /proc/config.gz | grep CONFIG_FTRACE
# Restrict tracing interface to root only
chmod 600 /sys/kernel/tracing/set_event
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
