---
id: CVE-2026-74636
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Fix race between update_event_fields and, event_define_fields

  The following sequence may leads race between event_define_fields()
  and update_event_fields():

  …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Fix race between update_event_fields and, event_define_fields

  The following sequence may leads race between event_define_fields()
  and update_event_fields():

  …
severity: none
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74636'
references:
  - url: 'https://git.kernel.org/stable/c/4e39f7b4d9d36508c53e89e6cbc640728df870b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a30d421468300b1e7b2f233136aeb2db8013f555'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c3730b8373bb5059d735509b9e6a00d7eb337d7c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e5f1d301b4bdaa4206db251fdc691f623162b0a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ed49684e69f846bf50b5050651ccdb87cfd152c0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f128740f39ab28d1f4ad5bdd10f3e117eec0c374'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdeb190b0905a6aaed1e5d6adfb8613214748d7d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00173
epssPercentile: 0.06176
ingestedAt: '2026-10-14T13:30:58.522Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix race between update_event_fields and, event_define_fields

The following sequence may leads race between event_define_fields()
and update_event_fields():

 CPU0 (loads module A)                      CPU1 (loads module B)
 ===============================            ===============================
 load_module(A)                             load_module(B)
   notifier_call_chain                        notifier_call_chain
     trace_module_notify                        trace_module_notify
       mutex_lock(&event_mutex)                   trace_event_update_all()
         trace_module_add_events(A)                 down_write(&trace_event_sem)
            __register_event(call_A)
              __add_event_to_tracers(call_A)
                event_define_fields(call_A)
                  for each f:                         list_for_each_entry(field,
                    list_add(&f->link,                                    &class->fields, link)
                             &class->fields)            field = class->fields->next;

Where access to the class->fields is not protected by the event_mutex in
trace_event_update_all().

This produces the following panic:
   Unable to handle kernel access ... at virtual address 0000000000000018
   pc : update_event_fields+0xf8/0x368
   Call trace:
    update_event_fields+0xf8/0x368
    trace_event_update_all+0x7c/0x2b4
    trace_module_notify+0x4c/0x1dc
    notifier_call_chain+0x84/0x168
    blocking_notifier_call_chain_robust+0x64/0xd4
    load_module+0x10c8/0x123c
    __arm64_sys_finit_module+0x230/0x31c

Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.