CVE-2026-74477

A flaw was found in the Linux kernel's uprobes mechanism. A local attacker could exploit a race condition by forking a task with a pending uretprobe while another CPU unregisters the uprobe. This could lead to a NULL pointer dereference in the hprobe_expire() function, causing a kernel oops and resulting in a system crash, effectively a denial of service.

This vulnerability is rated as Moderate impact because it requires local system access and precise timing during active dynamic tracing, limiting the outcome to a denial of service via a kernel crash without compromising system confidentiality or integrity. Successful exploitation depends on triggering a race condition between process cloning and probe unregistration while return probes are active. Red Hat Enterprise Linux releases are not affected because they do not contain the upstream commit that introduced this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.