CVE-2026-68174

Descripción

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In -struct trace_event_call-, the -module- pointer and the -refcnt- atomic variable share the same memory space in a union. For dynamic events, the union member is -refcnt-, which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its -call->module- evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing -:mod:<module>- to -set_event-), the code in -__ftrace_set_clr_event_nolock()- and -update_event_fields()- reads -call->module- directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a -struct module- pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the -TRACE_EVENT_FL_DYNAMIC- flag is checked before treating -call->module- as a valid pointer in these code paths.