tracing: Fix hist trigger timestamps for buffered events
Summary
| CVE | CVE-2026-99140 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-28 11:17:33 UTC |
| Updated | 2026-10-30 13:21:48 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp Call trace: ring_buffer_event_time_stamp hist_field_timestamp hist_fn_call event_hist_trigger event_triggers_call __event_trigger_test_discard trace_event_buffer_commit do_trace_event_raw_event_sched_switch trace_event_raw_event_sched_switch The warning is probabilistically reproducible and is related to syzkaller executing the following commands: echo 'prev_pid == 999999' > events/sched/sched_switch/filter echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger The specific triggering process is as follows: CPU 0 CPU 1 (context switching) (echo 'hist:keys=common_timestamp' > \ events/sched/sched_switch/trigger) do_trace_event_raw_event_##call trace_event_buffer_lock_reserve if (!tr->no_filter_buffering_ref && trace_file->flags & EVENT_FILE_FL_FILTERED) return entry; // return directly event_hist_trigger_parse hist_register_trigger tracing_set_filter_buffering(file->tr, true); tr->no_filter_buffering_ref++; __trace_buffer_lock_reserve rb_start_commit local_inc(&cpu_buffer->committing); // skipped and not executed trace_event_buffer_commit __event_trigger_test_discard event_triggers_call event_hist_trigger hist_fn_call hist_field_timestamp ring_buffer_event_time_stamp nest = local_read(&cpu_buffer->committing); WARN_ON_ONCE(!nest) // trigger warning The root cause is that when an event file has a filter attached and the hist trigger has not yet been attached, trace_event_buffer_lock_reserve() writes the event into the per-CPU trace_buffered_event temp buffer instead of reserving it in the ring buffer, so cpu_buffer->committing is not incremented. When the event is later processed at commit time by a hist trigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a zero committing count, triggering WARN_ON_ONCE(!nest). tracing_event_time_stamp() was added by commit d8279bfc5e959 ("tracing: Add tracing_event_time_stamp() API") for exactly this case: if the event is the per-CPU trace_buffered_event, it returns the current ring buffer timestamp. But it never gained a caller. Use it in hist_field_timestamp(), so that a hist trigger that races onto a buffered event records the current time, which is only marginally later than when the event was recorded, instead of warning and recording a bogus timestamp. |
Risk And Classification
EPSS: 0.001730000 probability, percentile 0.067370000 (date 2026-11-01)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e b3a94a79047d3fc9385b3709cb2b86f4a26ed0c3 git | Not specified |
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e 71c5c7420478d94d6eb0b427f66fa41bbda651e3 git | Not specified |
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e ab320f6aa3769480f735ed0ad026c4a61799b7bc git | Not specified |
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e af192a356e9830a0df231b590ad6fb1fc28c9315 git | Not specified |
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e 09c7cce2e59e6b3b1807520bcb1980c561f15d1e git | Not specified |
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e 89e90b16aadd6e66bd0323bc8dfc76a62e756b57 git | Not specified |
| CNA | Linux | Linux | affected b94bc80df64823e676b506f8de7dcf6a688d681e 9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0 git | Not specified |
| CNA | Linux | Linux | affected 5.13 | Not specified |
| CNA | Linux | Linux | unaffected 5.13 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.224 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.191 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.161 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.115 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.59 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.13 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/09c7cce2e59e6b3b1807520bcb1980c561f15d1e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9414ca3b99e5a7f1f3bf51c2a01b383e1b355dd0 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/af192a356e9830a0df231b590ad6fb1fc28c9315 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/b3a94a79047d3fc9385b3709cb2b86f4a26ed0c3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/89e90b16aadd6e66bd0323bc8dfc76a62e756b57 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/71c5c7420478d94d6eb0b427f66fa41bbda651e3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ab320f6aa3769480f735ed0ad026c4a61799b7bc | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.