tracing: Set the trace clock before registering the histogram trigger

{
  "id": "0cfd15d36d8d78039841c31cc8fb3300362b07ecb9721850a7de635889578183",
  "url": "https://osv.dev/vulnerability/CVE-2026-97935",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "tracing: Set the trace clock before registering the histogram trigger",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger hist_register_trigger() puts the trigger on the global named_triggers list in cmd_ops->init(), and only then sets the trace clock: if (data->cmd_ops->init) { ret = data->cmd_ops->init(data); if (ret < 0) goto out; } if (hist_data->enable_timestamps) { ret = tracing_set_clock(file->tr, hist_data->attrs->clock); if (ret) { hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock)); goto out; } The clock string is not checked anywhere before that call, so a named trigger using common_timestamp with an unknown clock fails after it has already become findable. event_hist_trigger_parse() then frees it without taking it off the list, and the next lookup by name reads the freed object: ~# cd /sys/kernel/tracing/events/sched/sched_switch ~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=foo:keys=common_pid' > trigger BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff88800915d760 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0x900 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 63: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Set the clock before the trigger is registered, so that nothing which can fail runs after it is published, the way commit 6f86bdeab633 (\"t",
    "evidence": "osv:CVE-2026-97935",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.273",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.224",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.191",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.112",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.53",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.7",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-97935",
      "aliases": [
        "CVE-2026-97935"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "a4072fe85ba3671720cab0788291af953db27318"
                },
                {
                  "fixed": "85e6df6e9cd489de8e238596a68b89eee0c03b88"
                },
                {
                  "fixed": "3568dabef3fb56517777ab981584f72ab1e90186"
                },
                {
                  "fixed": "c7b77c22adcf314ec8aa4807f01914dcbc62ed54"
                },
                {
                  "fixed": "578d39ab420b18b76a12fc8d0573ec041a84da28"
                },
                {
                  "fixed": "cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad"
                },
                {
                  "fixed": "cfad128171f8e2237a3c723d6478ef2cfb3b9127"
                },
                {
                  "fixed": "65d1e28198f344832a8a63e8ccf84b8f65b92a32"
                },
                {
                  "fixed": "6ede78d0563a2a3ae3e46f9c07cedb5d79645429"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97935.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.17.0"
                },
                {
                  "fixed": "5.10.273"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.224"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.112"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.53"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.7"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97935.json"
          }
        }
      ],
      "modified": "2026-11-01T02:30:54.366186271Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/3568dabef3fb56517777ab981584f72ab1e90186",
        "https://git.kernel.org/stable/c/578d39ab420b18b76a12fc8d0573ec041a84da28",
        "https://git.kernel.org/stable/c/65d1e28198f344832a8a63e8ccf84b8f65b92a32",
        "https://git.kernel.org/stable/c/6ede78d0563a2a3ae3e46f9c07cedb5d79645429",
        "https://git.kernel.org/stable/c/85e6df6e9cd489de8e238596a68b89eee0c03b88",
        "https://git.kernel.org/stable/c/c7b77c22adcf314ec8aa4807f01914dcbc62ed54",
        "https://git.kernel.org/stable/c/cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad",
        "https://git.kernel.org/stable/c/cfad128171f8e2237a3c723d6478ef2cfb3b9127",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97935.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-97935",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97935.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-97935",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 512418,
  "published_at": "2026-09-25T10:22:49.82+00:00"
}