CVE-2026-74490 is a race condition in the TIPC subsystem's poll() path. When userspace polls a TIPC socket, a tracepoint walks queue state to report backlog depth. Under specific concurrent event sequences, this trace executes while another thread modifies the queue, producing a use-after-free. The fix strips queue-dump capability from the poll trace entirely rather than adding the missing lock—a pattern that reveals something important about how the kernel treats trace code as a category.
Tracepaths were designed as observers: zero-overhead instrumentation that should not affect the system being traced. That design goal concerned performance, not concurrency, but the distinction collapsed over time. Developers assumed tracepoints were "safe to call from any context" because they were non-invasive—a conflation of zero-overhead with zero-side-effects. The consequence is that trace code walking shared state receives inconsistent locking compared to production data paths, not because of oversight but because of how the category itself was architected.
The fix choice is pragmatic but creates a blast-radius transfer. TIPC poll tracing was the primary window into queue state for production monitoring tools. Removing the queue-dump payload degrades that telemetry permanently—the vulnerability's impact was latent and hard to weaponize, but the observability loss is immediate and guaranteed. More importantly, this follows a documented kernel pattern: syzbot finds races in trace paths, and the standard response removes the capability rather than hardening it, because locking a hot poll path adds unacceptable overhead. That economic calculation is why this class keeps reproducing itself.
For defenders: audit other TIPC trace paths for state walks without locking, and extend that audit to tracepoints in other subsystems. The question is not whether this specific path is now safe but whether the kernel's trace infrastructure systematically produces this vulnerability class by treating observer paths as categorically exempt from the same threat modeling applied to production code. The pattern has recurred across multiple subsystems—each incident treated as novel, the category unaddressed.