CVE-2026-72385

A flaw was found in the Linux kernel's tracing/fprobe component. A race condition can occur in the fprobe_fgraph_entry() function during shadow-stack reservation. If a fprobe is registered on an already-live IP between two processing walks, it can lead to a NULL pointer dereference. This can result in a general protection fault, causing a system crash and a Denial of Service (DoS).

A NULL pointer dereference flaw in the Linux kernel's tracing/fprobe subsystem has been rated by Red Hat as Moderate severity. In fprobe_fgraph_entry(), the function-graph shadow-stack reservation is sized in one walk of the per-ip fprobe list and filled in a second walk, both protected only by rcu_read_lock(). If an fprobe is registered on an already-live instruction pointer between the two walks, the fill walk can process an exit_handler that the sizing walk did not count and write past the reserved shadow-stack words; when the sizing walk counted nothing, fgraph_data is NULL and the first write_fprobe_header() dereferences it, causing a general protection fault and a kernel crash (denial of service). Triggering the flaw requires local access with the privileges needed to register fprobes and enable function-graph tracing, and it affects only availability, with no impact on confidentiality or integrity. The vulnerable code is not present in any shipped Red Hat Enterprise Linux kernel or kernel-rt package, nor in the Red Hat In-Vehicle OS kernel packages (kernel, kernel-ivos-qualcomm), so all Red Hat product streams are marked NOTAFFECTED and no update is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.