{"api_version":"1","generated_at":"2026-08-05T02:35:13+00:00","cve":"CVE-2026-64451","urls":{"html":"https://cve.report/CVE-2026-64451","api":"https://cve.report/api/cve/CVE-2026-64451.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64451","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64451"},"summary":{"title":"tracing: Fix NULL pointer dereference in func_set_flag()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix NULL pointer dereference in func_set_flag()\n\nfunc_set_flag() dereferences tr->current_trace_flags before verifying\nthat the current tracer is actually the function tracer. When the active\ntracer has been switched away from \"function\" (e.g., to \"wakeup_rt\"),\ntr->current_trace_flags can be NULL, leading to a NULL pointer\ndereference and kernel crash.\n\nThe call chain that triggers this is:\n\n  trace_options_write()\n    -> __set_tracer_option()\n      -> trace->set_flag()          /* func_set_flag */\n\nIn func_set_flag(), the first operation is:\n\n  if (!!set == !!(tr->current_trace_flags->val & bit))\n\nThis dereferences tr->current_trace_flags unconditionally. The safety\ncheck that guards against a non-function tracer:\n\n  if (tr->current_trace != &function_trace)\n      return 0;\n\nis placed *after* the dereference, which is too late.\n\nThis was observed with the following crash dump:\n\n  BUG: unable to handle page fault at 0000000000000000\n  RIP: func_set_flag+0xd\n\n  Call Trace:\n   __set_tracer_option+0x27\n   trace_options_write+0x75\n   vfs_write+0x12a\n   ksys_write+0x66\n   do_syscall_64+0x5b\n\n  RIP: ffffffff914c973d  RSP: ff67ec88b01dfdf0  RFLAGS: 00010202\n  RAX: 0000000000000000  RBX: ff3a826e80354580  RCX: 0000000000000001\n  RDX: 0000000000000001  RSI: 0000000000000000  RDI: ffffffff93918080\n\nThe disassembly confirms the fault:\n\n  func_set_flag+0:   mov 0x1f08(%rdi), %rax  ; RAX = tr->current_trace_flags = NULL\n  func_set_flag+13:  mov (%rax), %eax        ; page fault: dereference NULL\n\nAt the time of the crash:\n  tr->current_trace_flags = 0x0 (NULL)\n  tr->current_trace = wakeup_rt_tracer (not function_trace)\n\nThe scenario is that a process opens a function tracer option file (such\nas \"func_stack_trace\"), then the current tracer is switched to another\ntracer (e.g., \"wakeup_rt\"), which sets current_trace_flags to NULL. When\nthe process subsequently writes to the option file, func_set_flag() is\ninvoked and crashes on the NULL dereference.\n\nFix this by moving the current_trace check before the\ncurrent_trace_flags dereference, so that func_set_flag() returns early\nwhen the function tracer is not active.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-25 10:17:30","updated_at":"2026-07-25 10:17:30"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/c3e94604675e3db186111b8942650d86577df9b0","name":"https://git.kernel.org/stable/c/c3e94604675e3db186111b8942650d86577df9b0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/69f17ac132a38974cf1defb480cef6b79d1ab768","name":"https://git.kernel.org/stable/c/69f17ac132a38974cf1defb480cef6b79d1ab768","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64451","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64451","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76680d0d2825900f23bf35290ab2b80bdf3a8e4a 69f17ac132a38974cf1defb480cef6b79d1ab768 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 76680d0d2825900f23bf35290ab2b80bdf3a8e4a c3e94604675e3db186111b8942650d86577df9b0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.4 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"64451","cve":"CVE-2026-64451","epss":"0.001620000","percentile":"0.058850000","score_date":"2026-07-28","updated_at":"2026-07-29 00:05:33"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace_functions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"69f17ac132a38974cf1defb480cef6b79d1ab768","status":"affected","version":"76680d0d2825900f23bf35290ab2b80bdf3a8e4a","versionType":"git"},{"lessThan":"c3e94604675e3db186111b8942650d86577df9b0","status":"affected","version":"76680d0d2825900f23bf35290ab2b80bdf3a8e4a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace_functions.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc3","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix NULL pointer dereference in func_set_flag()\n\nfunc_set_flag() dereferences tr->current_trace_flags before verifying\nthat the current tracer is actually the function tracer. When the active\ntracer has been switched away from \"function\" (e.g., to \"wakeup_rt\"),\ntr->current_trace_flags can be NULL, leading to a NULL pointer\ndereference and kernel crash.\n\nThe call chain that triggers this is:\n\n  trace_options_write()\n    -> __set_tracer_option()\n      -> trace->set_flag()          /* func_set_flag */\n\nIn func_set_flag(), the first operation is:\n\n  if (!!set == !!(tr->current_trace_flags->val & bit))\n\nThis dereferences tr->current_trace_flags unconditionally. The safety\ncheck that guards against a non-function tracer:\n\n  if (tr->current_trace != &function_trace)\n      return 0;\n\nis placed *after* the dereference, which is too late.\n\nThis was observed with the following crash dump:\n\n  BUG: unable to handle page fault at 0000000000000000\n  RIP: func_set_flag+0xd\n\n  Call Trace:\n   __set_tracer_option+0x27\n   trace_options_write+0x75\n   vfs_write+0x12a\n   ksys_write+0x66\n   do_syscall_64+0x5b\n\n  RIP: ffffffff914c973d  RSP: ff67ec88b01dfdf0  RFLAGS: 00010202\n  RAX: 0000000000000000  RBX: ff3a826e80354580  RCX: 0000000000000001\n  RDX: 0000000000000001  RSI: 0000000000000000  RDI: ffffffff93918080\n\nThe disassembly confirms the fault:\n\n  func_set_flag+0:   mov 0x1f08(%rdi), %rax  ; RAX = tr->current_trace_flags = NULL\n  func_set_flag+13:  mov (%rax), %eax        ; page fault: dereference NULL\n\nAt the time of the crash:\n  tr->current_trace_flags = 0x0 (NULL)\n  tr->current_trace = wakeup_rt_tracer (not function_trace)\n\nThe scenario is that a process opens a function tracer option file (such\nas \"func_stack_trace\"), then the current tracer is switched to another\ntracer (e.g., \"wakeup_rt\"), which sets current_trace_flags to NULL. When\nthe process subsequently writes to the option file, func_set_flag() is\ninvoked and crashes on the NULL dereference.\n\nFix this by moving the current_trace check before the\ncurrent_trace_flags dereference, so that func_set_flag() returns early\nwhen the function tracer is not active."}],"providerMetadata":{"dateUpdated":"2026-07-25T08:51:21.020Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/69f17ac132a38974cf1defb480cef6b79d1ab768"},{"url":"https://git.kernel.org/stable/c/c3e94604675e3db186111b8942650d86577df9b0"}],"title":"tracing: Fix NULL pointer dereference in func_set_flag()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-64451","datePublished":"2026-07-25T08:51:21.020Z","dateReserved":"2026-07-19T15:36:31.788Z","dateUpdated":"2026-07-25T08:51:21.020Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-25 10:17:30","lastModifiedDate":"2026-07-25 10:17:30","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64451","Ordinal":"1","Title":"tracing: Fix NULL pointer dereference in func_set_flag()","CVE":"CVE-2026-64451","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64451","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix NULL pointer dereference in func_set_flag()\n\nfunc_set_flag() dereferences tr->current_trace_flags before verifying\nthat the current tracer is actually the function tracer. When the active\ntracer has been switched away from \"function\" (e.g., to \"wakeup_rt\"),\ntr->current_trace_flags can be NULL, leading to a NULL pointer\ndereference and kernel crash.\n\nThe call chain that triggers this is:\n\n  trace_options_write()\n    -> __set_tracer_option()\n      -> trace->set_flag()          /* func_set_flag */\n\nIn func_set_flag(), the first operation is:\n\n  if (!!set == !!(tr->current_trace_flags->val & bit))\n\nThis dereferences tr->current_trace_flags unconditionally. The safety\ncheck that guards against a non-function tracer:\n\n  if (tr->current_trace != &function_trace)\n      return 0;\n\nis placed *after* the dereference, which is too late.\n\nThis was observed with the following crash dump:\n\n  BUG: unable to handle page fault at 0000000000000000\n  RIP: func_set_flag+0xd\n\n  Call Trace:\n   __set_tracer_option+0x27\n   trace_options_write+0x75\n   vfs_write+0x12a\n   ksys_write+0x66\n   do_syscall_64+0x5b\n\n  RIP: ffffffff914c973d  RSP: ff67ec88b01dfdf0  RFLAGS: 00010202\n  RAX: 0000000000000000  RBX: ff3a826e80354580  RCX: 0000000000000001\n  RDX: 0000000000000001  RSI: 0000000000000000  RDI: ffffffff93918080\n\nThe disassembly confirms the fault:\n\n  func_set_flag+0:   mov 0x1f08(%rdi), %rax  ; RAX = tr->current_trace_flags = NULL\n  func_set_flag+13:  mov (%rax), %eax        ; page fault: dereference NULL\n\nAt the time of the crash:\n  tr->current_trace_flags = 0x0 (NULL)\n  tr->current_trace = wakeup_rt_tracer (not function_trace)\n\nThe scenario is that a process opens a function tracer option file (such\nas \"func_stack_trace\"), then the current tracer is switched to another\ntracer (e.g., \"wakeup_rt\"), which sets current_trace_flags to NULL. When\nthe process subsequently writes to the option file, func_set_flag() is\ninvoked and crashes on the NULL dereference.\n\nFix this by moving the current_trace check before the\ncurrent_trace_flags dereference, so that func_set_flag() returns early\nwhen the function tracer is not active.","Type":"Description","Title":"tracing: Fix NULL pointer dereference in func_set_flag()"}]}}}