Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed. Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:51.847Z",
  "pubdate": "2026-08-15T13:17:51.847Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel tracing subsystem, specifically within the trace_module_add_events() function.\nThe vulnerability type is a use-after-free resulting from improper error handling during kernel module event registration.\nThe impact includes potential kernel memory corruption, arbitrary code execution, and system instability.\nAffected systems include Linux kernel environments utilizing the ftrace and tracefs subsystems where kernel modules with tracing events are loaded and unloaded.\nRisk implications are severe, as successful exploitation could allow an attacker with local execution privileges or the ability to load kernel modules to compromise the operating system kernel.\nAttacker capabilities require the ability to interact with the kernel tracing subsystem or load/unload kernel modules.\nExploitation requirements include triggering a failure condition during __register_event() while concurrently interacting with tracefs or tracing operations referencing stale pointers.",
  "technicalDetails": "The vulnerability stems from the trace_module_add_events() function failing to check the return value of __register_event() during kernel module initialization.\nWhen __register_event() fails—such as when event_init() encounters an error—the corresponding trace_event_call structure is not properly added to the ftrace_events list.\nDespite the registration failure, trace_module_add_events() unconditionally proceeds to execute __add_event_to_tracers().\nThis subsequent function creates a trace_event_file instance that holds a pointer to the unregistered and unlisted trace_event_call.\nWhen the kernel module loading process subsequently fails or the module is unloaded, the associated module memory is freed back to the system.\nThe tracing state retains the stale trace_event_call pointer within the trace_event_file structure, preserving a reference to deallocated memory.\nSubsequent execution of tracefs operations or general tracing subsystem interactions that access this stale pointer trigger a use-after-free condition.\nThe vulnerable component is the trace_module_add_events() function inside the Linux kernel tracing infrastructure.\nExploitation occurs step-by-step as follows: First, an attacker or system process initiates the loading of a kernel module designed or manipulated to fail during event registration (__register_event()). Second, the error is ignored by the tracing subsystem, creating a trace_event_file pointing to the soon-to-be-freed trace_event_call. Third, module unloading frees the memory region occupied by the trace_event_call. Fourth, the attacker triggers read or write operations against the tracefs filesystem involving the affected event file, causing the kernel to dereference the dangling pointer.\nPost-exploitation impact includes kernel panics, denial of service, or potential privilege escalation if memory reuse can be deterministically controlled."
}