{"id":"CVE-2026-74471","revision":"c70555973f344c59a9e79bc701bd88e5","records":[{"revision":"c70555973f344c59a9e79bc701bd88e5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74471","aliases":[],"title":"tracing: Check return value of __register_event() in trace_module_add_events()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check return value of __register_event() in trace_module_add_events()\n\ntrace_module_add_events() ignores the return value of __register_event()\nand unconditionally calls __add_event_to_tracers() for each event.\n\nIf __register_event() fails (for example, if event_init() fails), the\ntrace_event_call is not added to ftrace_events list, but\n__add_event_to_tracers() still creates a trace_event_file pointing to it.\nIf module loading subsequently fails and module memory is freed, tracing\nstate retains a stale trace_event_call pointer in trace_event_file,\nleading to a use-after-free when tracefs or tracing subsystem operations\nare later executed.\n\nFix this by checking the return value of __register_event() and only\ncalling __add_event_to_tracers() if event registration succeeded.","state":0,"publishedAt":"2026-08-15T12:27:08.128+00:00","modifiedAt":"2026-10-16T19:05:47.824+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"3bf965a2827c44f03294107703e7ba53fbd0a69a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"9d6d79744f01eacaf3d5522f4fcd59939581abfd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"54b7a358f6399c1242d2fb7f4f96085af34baa5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"22f954f7a8afe975e85517aff41b35defe05144b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"000765dcdc3edf128990762790543adc4b868f6c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ae63b31e4d0e2ec09c569306ea46f664508ef717\",\n                            \"lessThan\": \"ac8719969e6c3c54e939834df812bc41f25453cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.151\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.103\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.44\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.8\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a","https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd","https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e","https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5","https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b","https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca","https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c","https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74471","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74471","identifiers":["CVE-2026-74471"]},"retained":false,"historicalAffected":[]}],"coverage":[]}