In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module
    and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic
    variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which
    acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or
    wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its
    'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for
    a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in
    '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without
    checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a
    'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the
    module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating
    'call->module' as a valid pointer in these code paths. (CVE-2026-68174)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module     and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic     variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which     acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or     wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its     'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for     a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in     '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without     checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a     'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the     module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating     'call->module' as a valid pointer in these code paths. (CVE-2026-68174)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
471070	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
471070	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
471026	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
471026	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
334795	Linux Distros Unpatched Vulnerability : CVE-2026-68174	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-68174

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

medium