CVE-2026-97934
Received Received - Intake

Memory Corruption in Linux Kernel via STACKTRACE Histogram

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parse_field() maps them onto their common_* equivalents for backward compatibility, but unlike the common_* names it hands the placeholder back to the caller instead of NULL. create_hist_field() takes a non-NULL field as a promise that the record carries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc word is read from offset 0, that is from common_type, and its low 16 bits are followed as an offset into the record. What is found there becomes the length of an unbounded memcpy. Pick an event whose id is small enough that the offset stays inside its own record and the length is a kernel text address: # cd /sys/kernel/tracing # echo 'hist:keys=STACKTRACE' > events/ftrace/print/trigger # echo hello > trace_marker Oops: general protection fault, probably for non-canonical address RIP: 0010:rb_next+0x23/0x60 </IRQ> RIP: 0010:memcpy+0xc/0x30 event_hist_trigger+0x2e7/0x12c0 Kernel panic - not syncing: Fatal exception in interrupt Leave the field NULL, which is what the comment above the branch says the code does and what common_stacktrace already does. FILTER_CPU and FILTER_COMM are left alone, their create_hist_field() branches never look at the field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97934
EUVD
EUVD-2026-86788

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory corruption issue in the tracing subsystem. It occurs when using STACKTRACE as a histogram key, which leads to an unbounded memcpy operation. The issue arises because parse_field() returns a non-NULL placeholder for generic fields like STACKTRACE, causing create_hist_field() to incorrectly assume a stacktrace is present. This results in reading an invalid offset and length, leading to a kernel panic or general protection fault.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and requires local system access to detect. Check if your kernel version includes the vulnerable code by examining the tracing subsystem. Run: cat /sys/kernel/tracing/available_filter_functions | grep stacktrace. If this returns results, your system may be affected. Additionally, check kernel logs for traces of the described exploit pattern.

Impact Analysis

This vulnerability can cause system crashes, including kernel panics, leading to denial of service. An attacker with local access could exploit it to trigger a crash by writing to trace_marker after setting a malicious histogram trigger. This may result in system instability or unavailability.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If an update is not immediately available, disable the tracing subsystem by setting kernel.tracing_on=0 or unloading the tracing modules. Avoid using STACKTRACE or related fields in histogram triggers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97934. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart