CVE-2026-97924
Received Received - Intake

tracing/user_events Field List Corruption in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Don't destroy fields when event removal fails destroy_user_event() destroys the event's fields before attempting to remove the trace event call. If user_event_set_call_visible() fails, e.g. because the event is still enabled and trace_remove_event_call() returns -EBUSY, the event is left registered with an irreversibly destroyed field list. Any subsequent interaction with the event then operates on an empty field list while it is still fully visible in tracefs. Move the field destruction after the call removal, and splice the field list back onto the event when the removal fails so the event remains in a consistent state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97924
EUVD
EUVD-2026-86778

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where event fields are destroyed prematurely during event removal. If the removal fails, the event remains registered but with an empty field list, causing inconsistent behavior in tracefs interactions.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and does not have a direct network-based detection method. To check if your system is affected, verify the kernel version and look for the presence of user_events functionality in the tracing system. Commands like uname -r and ls /sys/kernel/tracing/ can help inspect the kernel and tracing subsystem.

Impact Analysis

It could lead to system instability or crashes if trace events are accessed after field destruction. Sensitive data exposure may occur if tracefs operations behave unpredictably due to missing fields.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, avoid enabling or interacting with user_events in the tracing subsystem until the update is applied. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart