Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96021.json
JSON Data
https://api.test.osv.dev/v1/vulns/AZL-96021
Upstream
Published
2026-08-15T13:17:51Z
Modified
2026-10-02T14:18:43Z
Summary
CVE-2026-74471 affecting package kernel for versions less than 6.6.152.1-1
Details

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check return value of __register_event() in trace_module_add_events()

trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event.

If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed.

Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.

References

Affected packages

Azure Linux:3 / kernel

Package

Name
kernel
Purl
pkg:rpm/azure-linux/kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.6.152.1-1

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96021.json"