CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix union collision of module and refcnt for dynamic events

In 'struct trace_event_call', the 'module' pointer and the 'refcnt'

atomic variable share the same memory space in a union. For dynamic

events, the union member is 'refcnt', which acts as an active

reference counter.

When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or

wprobe) has a non-zero reference count (e.g. due to active event

triggers or perf attachments), its 'call->module' evaluates to a

small non-zero integer instead of NULL.

When filtering or setting events for a specific module (e.g., writing

':mod:<module>' to 'set_event'), the code in

'__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads

'call->module' directly without checking whether the event is dynamic.

This causes the kernel to treat the small integer (refcnt) as a

'struct module' pointer, leading to a NULL/invalid pointer dereference

(Oops) when dereferencing the module name.

Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked

before treating 'call->module' as a valid pointer in these code paths.