{ "cveId": "CVE-2026-74477", "url": "https://patchblox.com/security/cve/CVE-2026-74477", "summary": "CVE-2026-74477 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-74477, released August 16, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_...", "description": "In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone() path: BUG: kernel NULL pointer dereference, address: 0000000000000018 Oops: 0002 [#1] SMP NOPTI RIP: 0010:hprobe_expire CR2: 0000000000000018 Call Trace: uprobe_copy_process copy_process kernel_clone __x64_sys_clone do_syscall_64 entry_SYSCALL_64_after_hwframe This was found on real hosts on Meta fleet. I\u0027ve got the impression that this is what is happening: CPU 1 CPU 2 (traced task) ----- ------------------- hit uprobe, prepare_uretprobe(): hprobe LEASED, refcount \u003E= 1 uprobe_unregister() put_uprobe(): refcount -\u003E 0 fork() -\u003E dup_utask() hprobe_expire(hprobe, true) try_get_uprobe() -\u003E NULL get_uprobe(NULL) \u003C-- Oops Only take the extra reference when the uprobe is non-NULL; a NULL means it is gone and is the correct value to return.", "published": "2026-08-15T13:17:52Z", "severity": "important", "epss": 0.00166, "epssPercentile": 0.05889, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.44-99.149", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.1.8-1", "fix": "DEBIAN-CVE-2026-74477", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74477", "released": "2026-08-16T22:48:20Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.44-99.149.amzn2023", "fix": "ALAS2023-2026-2106", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2106", "released": "2026-08-31T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }