CVE-2026-97919

Received Received - Intake

Use-After-Free in Linux Kernel Tracing Subsystem

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger event_hist_trigger_named_init() puts the trigger on the global named_triggers list and only then takes the reference on the trigger it shares its histogram with: data->ref++; save_named_trigger(data->named_data->name, data); ret = event_hist_trigger_init(data->named_data); if (ret < 0) { kfree(data->cmd_ops); data->cmd_ops = &trigger_hist_cmd; } return ret; event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and nothing takes the trigger back off the list on the way out. event_hist_trigger_parse() frees it, and the next lookup by name reads the freed object: BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff888009346860 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 67: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Do the reference first and publish once it has succeeded, so that nothing which can fail runs after the trigger becomes findable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97919

EUVD

EUVD-2026-86773

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's tracing subsystem. It occurs when a named histogram trigger is added to a global list before properly referencing it. If initialization fails later, the trigger remains on the list but is freed, leading to a dangling pointer. Subsequent lookups can then access the freed memory, causing a slab-use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and may not have direct network detection methods. Check kernel logs for slab-use-after-free errors related to named triggers using: dmesg | grep -i "KASAN: slab-use-after-free" or journalctl -k | grep -i "slab-use-after-free"

Impact Analysis

This vulnerability could allow an attacker with local access to cause a kernel crash or execute arbitrary code with elevated privileges. It may lead to denial-of-service conditions or potential privilege escalation on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel memory management issue. Compliance impacts would depend on how the affected system is used in a regulated environment rather than the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. Monitor kernel security advisories and apply patches promptly. If immediate patching is not possible, consider disabling histogram triggers via kernel boot parameters like trace_event=!hist or restricting access to tracing features.

Hi! I’m here to help you understand CVE-2026-97919. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70