CVE-2026-97932
Received Received - Intake

Linux Kernel Trace Event Use-After-Free Vulnerability

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference trace_event_file in deferred trigger free The enable_event trigger defers trace_event_put_ref() to the trigger free kthread, but the trace_event_file can already be freed when the instance is removed. Keep the trace_event_call directly in enable_trigger_data so the deferred free does not access the freed trace_event_file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97932
EUVD
EUVD-2026-86786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the tracing subsystem. When an event trigger is enabled, the system defers freeing a trace event reference to a cleanup thread. However, the trace event file may already be freed if the instance is removed, leading to a potential crash or memory corruption when the deferred cleanup tries to access the freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and may not have direct network detection methods. Check kernel logs for trace subsystem errors or crashes using: dmesg | grep -i trace. Review active tracing instances with: cat /sys/kernel/debug/tracing/instances/*/events. If crashes or unexpected behavior occur in tracing-related processes, further investigation is needed.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in systems running vulnerable Linux kernel versions. It may lead to denial-of-service conditions or potential privilege escalation if exploited maliciously.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-97932. Avoid using tracing triggers that may trigger deferred free operations until the update is applied. Monitor kernel logs for trace-related errors post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart