HIGHCVSS 7.8Vulnerability

CVE-2026-74471

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed. Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.

Properties

severity
HIGH
cvss_score
7.8
cvss_severity
HIGH
epss_score
0.00126
retrieved_at
2026-10-09T03:34:45+00:00
last_source
FIRST EPSS
score
7.8
cve_id
CVE-2026-74471
cvss_vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
signal_observed_at
2026-09-11T17:55:57+00:00
vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
published_at
2026-08-15T13:17:51.847
last_modified
2026-08-19T17:21:04.320
epss_percentile
0.0199

Related Entities (2)

ENRICHED_BY (1)

→[Source]FIRST EPSS

DESCRIBED_BY (1)

→[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph