Skip to content
Heist/ feed
Unrated

tracing: Undo the registration when enabling the histogram trigger fails

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled: list_add_tail_rcu(&data->list, &file->triggers); update_cond_flag(file); if (trace_event_trigger_enable_disable(file, 1) < 0) { list_del_rcu(&data->list); update_cond_flag(file); ret--; } so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway: BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference,

Announced Source revision 1
Original source ↗

CVE-2026-97918

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97918

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
        "lessThan": "880712b6f48103ba3a04b154ff076d45fe86dcec",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
        "lessThan": "c7ee2d5733574d4694f7c0035e4381f54c1fca27",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
        "lessThan": "51b07104d563d4be2be34158d3b9d922ca417642",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
        "lessThan": "bfa6bc11aef93a3d9db0ac9564b734849a9d959b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
        "lessThan": "92383cef66791a0c63a2f27755cadbdb2fbf270b",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "kernel/trace/trace_events_hist.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.17"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.17",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.112",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.53",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.7",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "kernel/trace/trace_events_hist.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-97918

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#48804 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement