---
id: CVE-2026-74471
title: 'tracing: Check return value of __register_event() in trace_module_add_events()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Check return value of __register_event() in trace_module_add_events()

  trace_module_add_events() ignores the return value of __register_event()
  and uncondition…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    3bf965a2827c44f03294107703e7ba53fbd0a69a
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    9d6d79744f01eacaf3d5522f4fcd59939581abfd
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    54b7a358f6399c1242d2fb7f4f96085af34baa5e
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    22f954f7a8afe975e85517aff41b35defe05144b
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    000765dcdc3edf128990762790543adc4b868f6c
  - >-
    Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 <
    ac8719969e6c3c54e939834df812bc41f25453cf
  - Linux 3.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:57:21.390624Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:47.824Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74471'
references:
  - url: 'https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a'
  - url: 'https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd'
  - url: 'https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e'
  - url: 'https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5'
  - url: 'https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b'
  - url: 'https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca'
  - url: 'https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c'
  - url: 'https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02032
ingestedAt: '2026-10-16T19:46:24.358Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check return value of __register_event() in trace_module_add_events()

trace_module_add_events() ignores the return value of __register_event()
and unconditionally calls __add_event_to_tracers() for each event.

If __register_event() fails (for example, if event_init() fails), the
trace_event_call is not added to ftrace_events list, but
__add_event_to_tracers() still creates a trace_event_file pointing to it.
If module loading subsequently fails and module memory is freed, tracing
state retains a stale trace_event_call pointer in trace_event_file,
leading to a use-after-free when tracefs or tracing subsystem operations
are later executed.

Fix this by checking the return value of __register_event() and only
calling __add_event_to_tracers() if event registration succeeded.

## Affected

- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 3bf965a2827c44f03294107703e7ba53fbd0a69a`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 9d6d79744f01eacaf3d5522f4fcd59939581abfd`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 54b7a358f6399c1242d2fb7f4f96085af34baa5e`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 22f954f7a8afe975e85517aff41b35defe05144b`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < 000765dcdc3edf128990762790543adc4b868f6c`
- `Linux >= ae63b31e4d0e2ec09c569306ea46f664508ef717 < ac8719969e6c3c54e939834df812bc41f25453cf`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.