In the Linux kernel, the following vulnerability has been resolved:
tracing: fprobe events: Fix possible UAF on modules
Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module refcount") moved try_module_get() from __find_tracepoint_module_cb() to find_tracepoint() caller, but that introduced a possible UAF because the module can be unloaded before try_module_get(). In this case, the module object should be freed too. Thus, try_module_get() does not only fail but may access to the freed object.
To avoid that, try_module_get() in __find_tracepoint_module_cb() again.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-realtimeUpgrade linux-image-gcpUpgrade linux-image-genericUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-aws-64kUpgrade linux-image-oracleUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.14.0-1008-gcp-64k | Jun 26, 2025 | May 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub