CVE-2026-89746

Received Received - Intake

Use-After-Free in Linux Kernel Tracing Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89746

EUVD

EUVD-2026-76658

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's tracing subsystem. It occurs when two hist triggers on different events use the same name, causing the second trigger to reuse the first's data. The bug leads to a dangling pointer in the trace_array reference, which is freed but not removed from the list. Later, accessing this freed data causes a kernel panic.

Detection Guidance

This vulnerability can be detected by attempting to reproduce the issue on the system. Run the following commands as root to check for kernel panic or crash: cd /sys/kernel/tracing; echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger; echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger; echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger. If the system panics or crashes, the vulnerability is present.

Check kernel logs for KASAN or general protection fault errors after running these commands.

Impact Analysis

This vulnerability can crash the entire system by triggering a kernel panic. An attacker with local access could exploit it to cause a denial-of-service condition, potentially leading to system instability or requiring a reboot to restore functionality.

Compliance Impact

This vulnerability is a kernel-level use-after-free flaw in the Linux tracing subsystem. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is not a data exposure or privacy issue. However, if exploited, it could lead to system instability or crashes, potentially causing denial-of-service conditions that might indirectly impact compliance by disrupting data processing or availability requirements.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Update to a kernel version that includes the fix for the tracing use-after-free vulnerability. Monitor kernel security advisories for updates.

If patching is not immediately possible, disable hist triggers in the kernel by setting tracefs permissions to restrict access or unmounting tracefs if not required.

Hi! I’m here to help you understand CVE-2026-89746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70