In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix race between update_event_fields and, event_define_fields
The following sequence may leads race between event_define_fields() and update_event_fields():
CPU0 (loads module A) CPU1 (loads module B) =============================== =============================== load_module(A) load_module(B) notifier_call_chain notifier_call_chain trace_module_notify trace_module_notify mutex_lock(&event_mutex) trace_event_update_all() trace_module_add_events(A) down_write(&trace_event_sem) __register_event(call_A) __add_event_to_tracers(call_A) event_define_fields(call_A) for each f: list_for_each_entry(field, list_add(&f->link, &class->fields, link) &class->fields) field = class->fields->next;
Where access to the class->fields is not protected by the event_mutex in trace_event_update_all().
This produces the following panic: Unable to handle kernel access ... at virtual address 0000000000000018 pc : update_event_fields+0xf8/0x368 Call trace: update_event_fields+0xf8/0x368 trace_event_update_all+0x7c/0x2b4 trace_module_notify+0x4c/0x1dc notifier_call_chain+0x84/0x168 blocking_notifier_call_chain_robust+0x64/0xd4 load_module+0x10c8/0x123c __arm64_sys_finit_module+0x230/0x31c
Fix by taking event_mutex in trace_event_update_all() before trace_event_sem.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18Upgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade kernel6.18-debuginfoUpgrade kernel-livepatch-6.18.48-107.148Upgrade kernel6.18-headersUpgrade kernel6.18-develUpgrade kernel6.18-toolsUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-modules-extraUpgrade perf6.18Upgrade microvm-kernel6.18Upgrade python3-perf6.18Upgrade python3-perf6.18-debuginfoUpgrade bpftool6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-tools-devel | Sep 30, 2026 | Aug 22, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | No solution exists | Aug 26, 2026 | Aug 22, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub