CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from "function" (e.g., to "wakeup_rt"), tr->current_trace_flags can be NULL, leading to a NULL pointer dereference and kernel crash. The call chain that triggers this is: trace_options_write() -> __set_tracer_option() -> trace->set_flag() /* func_set_flag */ In func_set_flag(), the first operation is: if (!!set == !!(tr->current_trace_flags->val & bit)) This dereferences tr->current_trace_flags unconditionally. The safety check that guards against a non-function tracer: if (tr->current_trace != &function_trace) return 0; is placed *after* the dereference, which is too late. This was observed with the following crash dump: BUG: unable to handle page fault at 0000000000000000 RIP: func_set_flag+0xd Call Trace: __set_tracer_option+0x27 trace_options_write+0x75 vfs_write+0x12a ksys_write+0x66 do_syscall_64+0x5b RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202 RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080 The disassembly confirms the fault: func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current_trace_flags = NULL func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL At the time of the crash: tr->current_trace_flags = 0x0 (NULL) tr->current_trace = wakeup_rt_tracer (not function_trace) The scenario is that a process opens a function tracer option file (such as "func_stack_trace"), then the current tracer is switched to another tracer (e.g., "wakeup_rt"), which sets current_trace_flags to NULL. When the process subsequently writes to the option file, func_set_flag() is invoked and crashes on the NULL dereference. Fix this by moving the current_trace check before the current_trace_flags dereference, so that func_set_flag() returns early when the function tracer is not active.

• https://git.kernel.org/stable/c/69f17ac132a38974cf1defb480cef6b79d1ab768
• https://git.kernel.org/stable/c/c3e94604675e3db186111b8942650d86577df9b0

Published

Jul 25, 2026

Last Modified

Aug 11, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64446In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64447In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64448In the Linux kernel, the following vulnerability has been re…8.2
• CVE-2026-64449In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-6445A flaw exists in FlashArray Purity where insufficient filter…8.7
• CVE-2026-64450In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-64452In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-64453In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64454In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64455In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64456In the Linux kernel, the following vulnerability has been re…7.7
• CVE-2026-64457In the Linux kernel, the following vulnerability has been re…