{"id":"CVE-2026-74471","title":"tracing: Check return value of __register_event() in trace_module_add_events()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check return value of __register_event() in trace_module_add_events()\n\ntrace_module_add_events() ignores the return value of __register_event()\nand uncondition…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 3bf965a2827c44f03294107703e7ba53fbd0a69a","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 9d6d79744f01eacaf3d5522f4fcd59939581abfd","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 54b7a358f6399c1242d2fb7f4f96085af34baa5e","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 22f954f7a8afe975e85517aff41b35defe05144b","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 000765dcdc3edf128990762790543adc4b868f6c","Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < ac8719969e6c3c54e939834df812bc41f25453cf","Linux 3.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:57:21.390624Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:47.824Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74471","references":[{"url":"https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a"},{"url":"https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd"},{"url":"https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e"},{"url":"https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5"},{"url":"https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b"},{"url":"https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca"},{"url":"https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c"},{"url":"https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02036,"ingestedAt":"2026-10-16T19:46:24.358Z","slug":"CVE-2026-74471","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check return value of __register_event() in trace_module_add_events()\n\ntrace_module_add_events() ignores the return value of __register_event()\nand unconditionally calls __add_event_to_tracers() for each event.\n\nIf __register_event() fails (for example, if event_init() fails), the\ntrace_event_call is not added to ftrace_events list, but\n__add_event_to_tracers() still creates a trace_event_file pointing to it.\nIf module loading subsequently fails and module memory is freed, tracing\nstate retains a stale trace_event_call pointer in trace_event_file,\nleading to a use-after-free when tracefs or tracing subsystem operations\nare later executed.\n\nFix this by checking the return value of __register_event() and only\ncalling __add_event_to_tracers() if event registration succeeded.\n\n## Affected\n\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 3bf965a2827c44f03294107703e7ba53fbd0a69a`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 9d6d79744f01eacaf3d5522f4fcd59939581abfd`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 54b7a358f6399c1242d2fb7f4f96085af34baa5e`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 22f954f7a8afe975e85517aff41b35defe05144b`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 000765dcdc3edf128990762790543adc4b868f6c`\n- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < ac8719969e6c3c54e939834df812bc41f25453cf`\n- `Linux 3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}