CVE-2026-68177

CVE CVE-2026-68177EUVD EUVD-2026-55278Published 2026-08-10T11:59:48.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enable_event" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enable_event data is put into the private_data_free() callback, but the put of the module refcount is done immediately. It is possible that if a module is removed that has an event that would enable (or disable) it is still active, it can read the data of the module after it is removed causing a use-after-free bug. Move the trace_event_put_ref() that releases the module into the delayed callback so that the module can not be removed until any reference to its events are finished.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 61d445af0a7c70018111919e47beaaee15653f2f <e091351b38818ef620d27f44f4bfd625f13afbff; 61d445af0a7c70018111919e47beaaee15653f2f <159fdc3e01dca5fdbc412fcd8b239895733a270d; 6.19; patch: 0; patch: 7.2-rc5; patch: 7.1.6

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.