tracing: Fix use-after-free with same-name named triggers

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89746
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:20:05 UTC
Updated2026-09-11 20:20:05 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 435d2964af815aae456db554c62963b4515f19d0 477d762be4b0ffaf01429ccd88859e93b0ec28cc git Not specified
CNA Linux Linux affected 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e b1a49c22de01faf176d44e5caa765e237353a579 git Not specified
CNA Linux Linux affected 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e 83d1ae0406d8eade219a81b401e201702dd9dc55 git Not specified
CNA Linux Linux affected 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e a7318172aa332a161fb9618286e64454c827f8fd git Not specified
CNA Linux Linux affected 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 git Not specified
CNA Linux Linux affected 43b254d46c740bf9dbe65709afa021dd726dfa99 git Not specified
CNA Linux Linux affected f1ae50cfb818ce1ac7a674406dfadb7653e2552d git Not specified
CNA Linux Linux affected 6.12.18 6.12.109 semver Not specified
CNA Linux Linux affected 6.1.130 6.2 semver Not specified
CNA Linux Linux affected 6.6.81 6.7 semver Not specified
CNA Linux Linux affected 6.13.6 6.14 semver Not specified
CNA Linux Linux affected 6.14 Not specified
CNA Linux Linux unaffected 6.14 semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report