CVE-2026-74471

A flaw was found in the Linux kernel's tracing subsystem. The trace_module_add_events() function does not properly check the return value of __register_event(). If event registration fails, a pointer to an event can still be created and retained even after the associated module memory is freed. This can lead to a use-after-free vulnerability when tracing operations are later executed, potentially causing system instability or a denial of service.

A use-after-free can be created in the tracing module event registration path because trace_module_add_events() added an event to tracer files even when __register_event() failed. If the module load later fails and module memory is freed, trace_event_file can keep a stale trace_event_call pointer that may be used by later tracefs or tracing operations. For the CVSS the PR:L is used in the paranoid score because some deployments delegate module or tracing control to service accounts or reduced capability root contexts, although normal arbitrary module loading is administrative. The issue is local and not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.