CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix race between update_event_fields and, event_define_fields

The following sequence may leads race between event_define_fields()

and update_event_fields():

CPU0 (loads module A) CPU1 (loads module B)

=============================== ===============================

load_module(A) load_module(B)

notifier_call_chain notifier_call_chain

trace_module_notify trace_module_notify

mutex_lock(&event_mutex) trace_event_update_all()

trace_module_add_events(A) down_write(&trace_event_sem)

__register_event(call_A)

__add_event_to_tracers(call_A)

event_define_fields(call_A)

for each f: list_for_each_entry(field,

list_add(&f->link, &class->fields, link)

&class->fields) field = class->fields->next;

Where access to the class->fields is not protected by the event_mutex in

trace_event_update_all().

This produces the following panic:

Unable to handle kernel access ... at virtual address 0000000000000018

pc : update_event_fields+0xf8/0x368

Call trace:

update_event_fields+0xf8/0x368

trace_event_update_all+0x7c/0x2b4

trace_module_notify+0x4c/0x1dc

notifier_call_chain+0x84/0x168

blocking_notifier_call_chain_robust+0x64/0xd4

load_module+0x10c8/0x123c

__arm64_sys_finit_module+0x230/0x31c

Fix by taking event_mutex in trace_event_update_all() before

trace_event_sem.