CVE-2026-74418

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

dma-fence: Fix potential tracepoint null pointer dereferences

Trace_dma_fence_signaled, trace_dma_fence_wait_end and

trace_dma_fence_destroy can all currently dereference a null fence->ops

pointer after it has been reset on fence signalling.

Lets use the safe string getters for most tracepoints to avoid this class

of a problem, while for the signal tracepoint we move it to before ops are

cleared to avoid losing the driver and timeline name information. Apart

from moving it we also need to add a new tracepoint class to bypass the

safe name getters since the signaled bit is already set.

For dma_fence_init we also need to use the new tracepoint class since the

rcu read lock is not held there, and we can do the same for the enable

signaling since there we are certain the fence cannot be signaled while

we are holding the lock and have even validated the fence->ops.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References