Use-after-free in Linux kernel - CVE-2026-74471

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in trace_module_add_events() and the tracing subsystem when handling failed event registration during module loading. A local user can load a module that triggers event registration failure and subsequently access tracefs or tracing operations to cause a denial of service.

Exploitation requires a module loading scenario in which event registration fails and the module memory is later freed, leaving a stale trace_event_call pointer in trace_event_file.

Affected software

How to mitigate CVE-2026-74471

External References

• https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c
• https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b
• https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf
• https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca
• https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5

Related Security Bulletins

• Use-after-free in Linux kernel trace
• Debian update for linux