CVE-2026-74418

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74418", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.893Z", "datePublished": "2026-08-15T05:59:23.440Z", "dateUpdated": "2026-08-17T05:19:01.013Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:19:01.013Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-fence: Fix potential tracepoint null pointer dereferences\n\nTrace_dma_fence_signaled, trace_dma_fence_wait_end and\ntrace_dma_fence_destroy can all currently dereference a null fence->ops\npointer after it has been reset on fence signalling.\n\nLets use the safe string getters for most tracepoints to avoid this class\nof a problem, while for the signal tracepoint we move it to before ops are\ncleared to avoid losing the driver and timeline name information. Apart\nfrom moving it we also need to add a new tracepoint class to bypass the\nsafe name getters since the signaled bit is already set.\n\nFor dma_fence_init we also need to use the new tracepoint class since the\nrcu read lock is not held there, and we can do the same for the enable\nsignaling since there we are certain the fence cannot be signaled while\nwe are holding the lock and have even validated the fence->ops."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma-buf/dma-fence.c", "include/trace/events/dma_fence.h"], "versions": [{"version": "541c8f2468b933acc5d129e84bd264923675a66e", "lessThan": "4e01fc9a5bc49b04fad403ffa71299b35e132ca8", "status": "affected", "versionType": "git"}, {"version": "541c8f2468b933acc5d129e84bd264923675a66e", "lessThan": "e94b9f01543cc6a83538c2c2cc645a424d3015ca", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma-buf/dma-fence.c", "include/trace/events/dma_fence.h"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4e01fc9a5bc49b04fad403ffa71299b35e132ca8"}, {"url": "https://git.kernel.org/stable/c/e94b9f01543cc6a83538c2c2cc645a424d3015ca"}], "title": "dma-fence: Fix potential tracepoint null pointer dereferences", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma-buf/dma-fence.c", "include/trace/events/dma_fence.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4e01fc9a5bc49b04fad403ffa71299b35e132ca8", "status": "affected", "version": "541c8f2468b933acc5d129e84bd264923675a66e", "versionType": "git"}, {"lessThan": "e94b9f01543cc6a83538c2c2cc645a424d3015ca", "status": "affected", "version": "541c8f2468b933acc5d129e84bd264923675a66e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma-buf/dma-fence.c", "include/trace/events/dma_fence.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-fence: Fix potential tracepoint null pointer dereferences\n\nTrace_dma_fence_signaled, trace_dma_fence_wait_end and\ntrace_dma_fence_destroy can all currently dereference a null fence->ops\npointer after it has been reset on fence signalling.\n\nLets use the safe string getters for most tracepoints to avoid this class\nof a problem, while for the signal tracepoint we move it to before ops are\ncleared to avoid losing the driver and timeline name information. Apart\nfrom moving it we also need to add a new tracepoint class to bypass the\nsafe name getters since the signaled bit is already set.\n\nFor dma_fence_init we also need to use the new tracepoint class since the\nrcu read lock is not held there, and we can do the same for the enable\nsignaling since there we are certain the fence cannot be signaled while\nwe are holding the lock and have even validated the fence->ops."}], "id": "CVE-2026-74418", "lastModified": "2026-08-17T06:19:37.283", "metrics": {}, "published": "2026-08-15T06:22:43.907", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4e01fc9a5bc49b04fad403ffa71299b35e132ca8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e94b9f01543cc6a83538c2c2cc645a424d3015ca"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: dma-fence: Fix potential tracepoint null pointer dereferences", "id": "2516785", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516785"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the `dma-fence` subsystem of the Linux kernel. This vulnerability allows for a null pointer dereference in tracepoint functions, such as `trace_dma_fence_signaled`, `trace_dma_fence_wait_end`, and `trace_dma_fence_destroy`, after a fence operation has been signaled and its internal pointers reset. An attacker could potentially exploit this to cause a system crash, leading to a denial of service."], "name": "CVE-2026-74418", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74418\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74418\nhttps://lore.kernel.org/linux-cve-announce/2026081512-CVE-2026-74418-0a40@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541c8f2468b933acc5d129e84bd264923675a66e,4e01fc9a5bc49b04fad403ffa71299b35e132ca8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541c8f2468b933acc5d129e84bd264923675a66e,e94b9f01543cc6a83538c2c2cc645a424d3015ca)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:00:08.920528+00:00", "updated": "2026-08-21T22:45:04.689504+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}