CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix NULL pointer dereference in funcsetflag()

funcsetflag() dereferences tr->currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from "function" (e.g., to "wakeuprt"), tr->currenttrace_flags can be NULL, leading to a NULL pointer dereference and kernel crash.

The call chain that triggers this is:

traceoptionswrite() -> _settraceroption() -> trace->setflag() /* funcsetflag */

In funcsetflag(), the first operation is:

if (!!set == !!(tr->currenttraceflags->val & bit))

This dereferences tr->currenttraceflags unconditionally. The safety check that guards against a non-function tracer:

if (tr->currenttrace != &functiontrace) return 0;

is placed after the dereference, which is too late.

This was observed with the following crash dump:

BUG: unable to handle page fault at 0000000000000000 RIP: funcsetflag+0xd

Call Trace: __settraceroption+0x27 traceoptionswrite+0x75 vfswrite+0x12a ksyswrite+0x66 dosyscall64+0x5b

RIP: ffffffff914c973d RSP: ff67ec88b01dfdf0 RFLAGS: 00010202 RAX: 0000000000000000 RBX: ff3a826e80354580 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffffff93918080

The disassembly confirms the fault:

funcsetflag+0: mov 0x1f08(%rdi), %rax ; RAX = tr->currenttraceflags = NULL funcsetflag+13: mov (%rax), %eax ; page fault: dereference NULL

At the time of the crash: tr->currenttraceflags = 0x0 (NULL) tr->currenttrace = wakeuprttracer (not functiontrace)

The scenario is that a process opens a function tracer option file (such as "funcstacktrace"), then the current tracer is switched to another tracer (e.g., "wakeuprt"), which sets currenttraceflags to NULL. When the process subsequently writes to the option file, funcset_flag() is invoked and crashes on the NULL dereference.

Fix this by moving the currenttrace check before the currenttraceflags dereference, so that funcset_flag() returns early when the function tracer is not active.