CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix NULL pointer dereference in func_set_flag()

func_set_flag() dereferences tr->current_trace_flags before verifying

that the current tracer is actually the function tracer. When the active

tracer has been switched away from "function" (e.g., to "wakeup_rt"),

tr->current_trace_flags can be NULL, leading to a NULL pointer

dereference and kernel crash.

The call chain that triggers this is:

trace_options_write()

-> __set_tracer_option()

-> trace->set_flag() /* func_set_flag */

In func_set_flag(), the first operation is:

if (!!set == !!(tr->current_trace_flags->val & bit))

This dereferences tr->current_trace_flags unconditionally. The safety

check that guards against a non-function tracer:

if (tr->current_trace != &function_trace)

return 0;

is placed *after* the dereference, which is too late.

This was observed with the following crash dump:

BUG: unable to handle page fault at 0000000000000000

RIP: func_set_flag+0xd

Call Trace:

__set_tracer_option+0x27

trace_options_write+0x75

vfs_write+0x12a

ksys_write+0x66

do_syscall_64+0x5b

RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202

RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001

RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080

The disassembly confirms the fault:

func_set_flag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->current_trace_flags = NULL

func_set_flag+13: mov (%rax), %eax ; page fault: dereference NULL

At the time of the crash:

tr->current_trace_flags = 0x0 (NULL)

tr->current_trace = wakeup_rt_tracer (not function_trace)

The scenario is that a process opens a function tracer option file (such

as "func_stack_trace"), then the current tracer is switched to another

tracer (e.g., "wakeup_rt"), which sets current_trace_flags to NULL. When

the process subsequently writes to the option file, func_set_flag() is

invoked and crashes on the NULL dereference.

Fix this by moving the current_trace check before the

current_trace_flags dereference, so that func_set_flag() returns early

when the function tracer is not active.