CVE-2026-74636: Linux Kernel Race Condition Vulnerability

CVE-2026-74636 Overview

CVE-2026-74636 is a race condition in the Linux kernel's tracing subsystem. The flaw occurs between event_define_fields() and update_event_fields() when two modules load concurrently on separate CPUs. The trace_event_update_all() function accesses class->fields without holding event_mutex, allowing another CPU to modify the list simultaneously. This produces a kernel panic caused by dereferencing an invalid pointer inside update_event_fields+0xf8/0x368. The vulnerability has been resolved upstream by taking event_mutex in trace_event_update_all() before trace_event_sem.

Critical Impact

Concurrent module loads can trigger a kernel panic through a list corruption in the tracing subsystem, leading to a local denial of service.

Affected Products

• Linux kernel (tracing subsystem, trace_event_update_all() code path)
• Distributions shipping affected kernel versions prior to the fix commits
• Systems that load multiple kernel modules concurrently while tracing is active

Discovery Timeline

• 2026-08-22 - CVE-2026-74636 published to NVD
• 2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74636

Vulnerability Analysis

The defect lives in the kernel tracing infrastructure that maintains per-event field metadata. When a module registers a new trace event, event_define_fields() iterates over the event's fields and calls list_add() to attach each field to class->fields. This path is executed under event_mutex.

A second CPU loading a different module reaches trace_event_update_all(), which walks class->fields under trace_event_sem only. Because event_mutex is not held on the reader side, the reader can observe partially-linked list nodes. The resulting NULL or invalid pointer dereference produces a kernel oops at virtual address 0x18, corresponding to the list_head->next offset of a torn entry.

The issue is a classic concurrency bug where two overlapping locking domains protect the same data structure inconsistently. Impact is limited to systems that dynamically load modules while tracing subscribers update event metadata.

Root Cause

The root cause is inconsistent locking of class->fields. Writers hold event_mutex, while trace_event_update_all() only holds trace_event_sem for writing. The reader in update_event_fields() therefore races with the writer in event_define_fields(), corrupting list traversal state.

Attack Vector

The vector is local. A privileged user or automated workload that loads multiple kernel modules in parallel can trigger the panic. Exploitation requires the CAP_SYS_MODULE capability (or equivalent) and is not remotely reachable. The observable outcome is a denial of service through a kernel crash, not memory disclosure or privilege escalation. See the upstream commits in the References section for the exact code paths involved.

Detection Methods for CVE-2026-74636

Indicators of Compromise

• Kernel oops referencing update_event_fields+0xf8/0x368 in dmesg or /var/log/kern.log
• Call trace containing trace_event_update_all, trace_module_notify, and notifier_call_chain
• Unexpected panics correlated with concurrent finit_module or init_module syscalls

Detection Strategies

• Inventory running kernel versions and compare against the fixed commits listed in the upstream references.
• Alert on repeated unplanned reboots on hosts that load third-party or out-of-tree modules.
• Correlate module load audit events (auditd MODULE_LOAD records) with subsequent kernel crashes.

Monitoring Recommendations

• Forward kernel logs to a centralized logging pipeline and pattern-match on update_event_fields and trace_event_update_all strings.
• Track finit_module syscall frequency per host to identify abnormal module-load bursts.
• Enable kernel crash dumps (kdump) to capture full stack traces when panics occur.

How to Mitigate CVE-2026-74636

Immediate Actions Required

• Apply the upstream kernel patches referenced by commit hashes 4e39f7b, a30d421, c3730b8, e5f1d30, ed49684, f128740, and fdeb190.
• Update to a distribution kernel that incorporates the fix and reboot affected systems.
• Restrict module-loading privileges to trusted administrators only.

Patch Information

The fix takes event_mutex inside trace_event_update_all() before acquiring trace_event_sem, aligning reader and writer locking. Patch details are available in the upstream stable tree via Kernel Git Commit a30d421 and the additional backport commits listed in the CVE references.

Workarounds

• Serialize kernel module loads on affected hosts to avoid concurrent load_module() execution.
• Disable dynamic module loading where feasible by setting kernel.modules_disabled=1 after boot.
• Reduce use of trace event subscribers on systems that must load modules frequently.

# Configuration example: lock down module loading after boot
sysctl -w kernel.modules_disabled=1