{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68177","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.373Z","datePublished":"2026-08-10T11:59:48.318Z","dateUpdated":"2026-08-17T05:00:18.452Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:00:18.452Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Delay module ref count for \"enable_event\" trigger\n\nTriggers are now delayed from freeing, but can still be triggered until\nafter the RCU grace period has ended. The freeing of the enable_event data\nis put into the private_data_free() callback, but the put of the module\nrefcount is done immediately.\n\nIt is possible that if a module is removed that has an event that would\nenable (or disable) it is still active, it can read the data of the module\nafter it is removed causing a use-after-free bug.\n\nMove the trace_event_put_ref() that releases the module into the delayed\ncallback so that the module can not be removed until any reference to its\nevents are finished."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local `write()` to tracefs event `trigger` files to register/remove `enable_event`/`disable_event` triggers and via local `delete_module(2)`/`rmmod` to unload the referenced trace-event module; no network, adjacent, or physical input path reaches `event_enable_trigger_free()` or `event_enable_trigger()`.\nAC:L - The attacker controls both sides of the race: one thread removes the trigger (premature `trace_event_put_ref()`) and unloads the module while another continuously fires the bound source tracepoint, exploiting the deferred-free window before `tracepoint_synchronize_unregister()` completes in the trigger cleanup kthread.\nPR:L - Trigger registration/removal is gated only by tracefs DAC and `LOCKDOWN_TRACEFS` without `capable()`, which Android/ChromeOS/Perfetto and tracing-group mounts grant to ordinary users; unloading the held module is achievable with `CAP_SYS_MODULE` in a user namespace on permissive kernels loading attacker-controlled modules.\nUI:N - The attacker performs trigger setup/removal, module unload, and source-event generation from their own threads; no separate victim user action is required once tracefs and module privileges are available.\nS:U - The use-after-free corrupts kernel heap/trace structures within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After premature `trace_event_put_ref()` permits module removal, in-flight `event_enable_trigger()`/`event_enable_count_func()` dereference freed `trace_event_file` and module-resident `trace_event_call` data, exposing reclaimed kernel heap contents.\nI:H - `event_enable_trigger()` performs `set_bit`/`clear_bit` on `enable_data->file->flags` through a pointer to a kmem_cache-freed `trace_event_file`, giving a controllable kernel write primitive via heap shaping.\nA:H - Dereferencing freed module/event-file memory from tracepoint context readily causes kernel oops/panic, and the attacker can repeat the race at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_trigger.c"],"versions":[{"version":"61d445af0a7c70018111919e47beaaee15653f2f","lessThan":"159fdc3e01dca5fdbc412fcd8b239895733a270d","status":"affected","versionType":"git"},{"version":"61d445af0a7c70018111919e47beaaee15653f2f","lessThan":"e091351b38818ef620d27f44f4bfd625f13afbff","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_trigger.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/159fdc3e01dca5fdbc412fcd8b239895733a270d"},{"url":"https://git.kernel.org/stable/c/e091351b38818ef620d27f44f4bfd625f13afbff"}],"title":"tracing: Delay module ref count for \"enable_event\" trigger","x_generator":{"engine":"bippy-1.2.0"}}}}