PT-2026-64672 · Linux · Linux
CVE-2026-64451
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix NULL pointer dereference in func set flag()
func set flag() dereferences tr->current trace flags before verifying
that the current tracer is actually the function tracer. When the active
tracer has been switched away from "function" (e.g., to "wakeup rt"),
tr->current trace flags can be NULL, leading to a NULL pointer
dereference and kernel crash.
The call chain that triggers this is:
trace options write()
-> set tracer option()
-> trace->set flag() /* func set flag */
In func set flag(), the first operation is:
if (!!set == !!(tr->current trace flags->val & bit))
This dereferences tr->current trace flags unconditionally. The safety
check that guards against a non-function tracer:
if (tr->current trace != &function trace)
return 0;
is placed after the dereference, which is too late.
This was observed with the following crash dump:
BUG: unable to handle page fault at 0000000000000000
RIP: func set flag+0xd
Call Trace:
set tracer option+0x27
trace options write+0x75
vfs write+0x12a
ksys write+0x66
do syscall 64+0x5b
RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202
RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080
The disassembly confirms the fault:
func set flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current trace flags = NULL
func set flag+13: mov (%rax), %eax ; page fault: dereference NULL
At the time of the crash:
tr->current trace flags = 0x0 (NULL)
tr->current trace = wakeup rt tracer (not function trace)
The scenario is that a process opens a function tracer option file (such
as "func stack trace"), then the current tracer is switched to another
tracer (e.g., "wakeup rt"), which sets current trace flags to NULL. When
the process subsequently writes to the option file, func set flag() is
invoked and crashes on the NULL dereference.
Fix this by moving the current trace check before the
current trace flags dereference, so that func set flag() returns early
when the function tracer is not active.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux