CVE-2026-74633

A flaw was found in the Linux kernel's tracing module. A local user can trigger a NULL pointer dereference by attempting to remove a specific event filter for an unloaded module. This vulnerability arises when a module-only event filter is cached with a null match, and a subsequent write operation passes this null value to a string comparison function. Successful exploitation leads to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Low severity because triggering the issue requires local administrative privileges to interact with the kernel event tracing interface. On standard Red Hat Enterprise Linux deployments, access to the tracefs filesystem is restricted to privileged accounts by default. Furthermore, exploitation is limited to causing a kernel crash resulting in a denial of service, with no compromise to system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.