{"api_version":"1","generated_at":"2026-08-15T08:45:14+00:00","cve":"CVE-2026-74418","urls":{"html":"https://cve.report/CVE-2026-74418","api":"https://cve.report/api/cve/CVE-2026-74418.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74418","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74418"},"summary":{"title":"dma-fence: Fix potential tracepoint null pointer dereferences","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-fence: Fix potential tracepoint null pointer dereferences\n\nTrace_dma_fence_signaled, trace_dma_fence_wait_end and\ntrace_dma_fence_destroy can all currently dereference a null fence->ops\npointer after it has been reset on fence signalling.\n\nLets use the safe string getters for most tracepoints to avoid this class\nof a problem, while for the signal tracepoint we move it to before ops are\ncleared to avoid losing the driver and timeline name information. Apart\nfrom moving it we also need to add a new tracepoint class to bypass the\nsafe name getters since the signaled bit is already set.\n\nFor dma_fence_init we also need to use the new tracepoint class since the\nrcu read lock is not held there, and we can do the same for the enable\nsignaling since there we are certain the fence cannot be signaled while\nwe are holding the lock and have even validated the fence->ops.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:43","updated_at":"2026-08-15 06:22:43"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/4e01fc9a5bc49b04fad403ffa71299b35e132ca8","name":"https://git.kernel.org/stable/c/4e01fc9a5bc49b04fad403ffa71299b35e132ca8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e94b9f01543cc6a83538c2c2cc645a424d3015ca","name":"https://git.kernel.org/stable/c/e94b9f01543cc6a83538c2c2cc645a424d3015ca","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74418","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74418","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 541c8f2468b933acc5d129e84bd264923675a66e 4e01fc9a5bc49b04fad403ffa71299b35e132ca8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 541c8f2468b933acc5d129e84bd264923675a66e e94b9f01543cc6a83538c2c2cc645a424d3015ca git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma-buf/dma-fence.c","include/trace/events/dma_fence.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4e01fc9a5bc49b04fad403ffa71299b35e132ca8","status":"affected","version":"541c8f2468b933acc5d129e84bd264923675a66e","versionType":"git"},{"lessThan":"e94b9f01543cc6a83538c2c2cc645a424d3015ca","status":"affected","version":"541c8f2468b933acc5d129e84bd264923675a66e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma-buf/dma-fence.c","include/trace/events/dma_fence.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.1"},{"lessThan":"7.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"7.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-fence: Fix potential tracepoint null pointer dereferences\n\nTrace_dma_fence_signaled, trace_dma_fence_wait_end and\ntrace_dma_fence_destroy can all currently dereference a null fence->ops\npointer after it has been reset on fence signalling.\n\nLets use the safe string getters for most tracepoints to avoid this class\nof a problem, while for the signal tracepoint we move it to before ops are\ncleared to avoid losing the driver and timeline name information. Apart\nfrom moving it we also need to add a new tracepoint class to bypass the\nsafe name getters since the signaled bit is already set.\n\nFor dma_fence_init we also need to use the new tracepoint class since the\nrcu read lock is not held there, and we can do the same for the enable\nsignaling since there we are certain the fence cannot be signaled while\nwe are holding the lock and have even validated the fence->ops."}],"providerMetadata":{"dateUpdated":"2026-08-15T05:59:23.440Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/4e01fc9a5bc49b04fad403ffa71299b35e132ca8"},{"url":"https://git.kernel.org/stable/c/e94b9f01543cc6a83538c2c2cc645a424d3015ca"}],"title":"dma-fence: Fix potential tracepoint null pointer dereferences","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74418","datePublished":"2026-08-15T05:59:23.440Z","dateReserved":"2026-08-15T05:44:03.893Z","dateUpdated":"2026-08-15T05:59:23.440Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:43","lastModifiedDate":"2026-08-15 06:22:43","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74418","Ordinal":"1","Title":"dma-fence: Fix potential tracepoint null pointer dereferences","CVE":"CVE-2026-74418","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74418","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-fence: Fix potential tracepoint null pointer dereferences\n\nTrace_dma_fence_signaled, trace_dma_fence_wait_end and\ntrace_dma_fence_destroy can all currently dereference a null fence->ops\npointer after it has been reset on fence signalling.\n\nLets use the safe string getters for most tracepoints to avoid this class\nof a problem, while for the signal tracepoint we move it to before ops are\ncleared to avoid losing the driver and timeline name information. Apart\nfrom moving it we also need to add a new tracepoint class to bypass the\nsafe name getters since the signaled bit is already set.\n\nFor dma_fence_init we also need to use the new tracepoint class since the\nrcu read lock is not held there, and we can do the same for the enable\nsignaling since there we are certain the fence cannot be signaled while\nwe are holding the lock and have even validated the fence->ops.","Type":"Description","Title":"dma-fence: Fix potential tracepoint null pointer dereferences"}]}}}