{
  "cveId": "CVE-2026-74633",
  "url": "https://patchblox.com/security/cve/CVE-2026-74633",
  "summary": "CVE-2026-74633 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-74633, released September 4, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix NULL pointer dereference in module...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix NULL pointer dereference in module event cache removal  A module-only event filter such as \u0022:mod:foo\u0022 is cached with a NULL event_mod-\u003Ematch when foo has not been loaded. If a later write tries to remove a specific match from the same module, remove_cache_mod() passes the NULL cached match to strcmp(), causing a NULL pointer dereference.  The issue can be reproduced from userspace:    echo \u0027:mod:trace_events_kunit_missing\u0027 \u003E /sys/kernel/tracing/set_event   echo \u0027!foo_bar:mod:trace_events_kunit_missing\u0027 \u003E\u003E /sys/kernel/tracing/set_event  The second write must be a concatenation (\u0022\u003E\u003E\u0022) to not include O_TRUNC as that would cause ftrace_clear_events() to clear the cached modules lines.  The crash was reproduced on x86_64 QEMU while KUnit workers contended on the event tracing path:    BUG: kernel NULL pointer dereference, address: 0000000000000000   #PF: supervisor read access in kernel mode   RIP: 0010:strcmp\u002B0x10/0x30   Call Trace:    __ftrace_set_clr_event_nolock\u002B0x373/0x4a0    ftrace_set_clr_event\u002B0xf0/0x180    ftrace_event_write\u002B0xdf/0x110    vfs_write\u002B0xf6/0x440    ksys_write\u002B0x68/0xe0    do_syscall_64\u002B0xf9/0x540    entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  Check event_mod-\u003Ematch before comparing it, consistent with the existing NULL checks for the cached system and event fields. The mismatched removal continues to return -EINVAL; a broad cached module filter is removed with \u0022!:mod:\u003Cmodule\u003E\u0022.",
  "published": "2026-08-22T16:16:36Z",
  "severity": "important",
  "epss": 0.00166,
  "epssPercentile": 0.05882,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.18.48-107.148",
      "release": "amzn 2023",
      "fixedVersion": "1:1.0-0.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-headers",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-modules-extra",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-modules-extra-common",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel6.18-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.9-1",
      "fix": "DEBIAN-CVE-2026-74633",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74633",
      "released": "2026-09-04T01:46:23Z"
    },
    {
      "platform": "linux",
      "product": "microvm-kernel6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "perf6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.18",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf6.18-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:6.18.48-107.148.amzn2023",
      "fix": "ALAS2023-2026-3139",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3139",
      "released": "2026-09-28T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}