{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-99234", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.402Z", "datePublished": "2026-11-02T16:06:41.083Z", "dateUpdated": "2026-11-02T16:06:41.083Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-02T16:06:41.083Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n events/sched/sched_waking/trigger\n # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n >> events/sched/sched_switch/trigger\n # cat events/sched/sched_waking/trigger\n hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_events_hist.c" ], "versions": [ { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "f21351d1c4cdcc6a68f03636a407c2af1a5e1e10", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "dba0f492703956801149cc70b39d2650a37995c3", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "a3d7ffd2409700748a495b645948fef48199206e", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "aae0ccd7326eef78dcdefffef3d1253e6f0615ca", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "8482ec5b65f606d5bbcec518e0afc69ad65ca414", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "431959fc76456cbba539279fe8967aa9391e6f23", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "5afb9317e2eeb1c7021a82995ce244fda5a4bd4f", "status": "affected", "versionType": "git" }, { "version": "02205a6752f223779a1b0e9e8ffacbea6e717851", "lessThan": "d0090baf02dd08f6e909f36f0ad54a4e80f5e79b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_events_hist.c" ], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.60", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3.1", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.273" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.191" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.161" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.115" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.60" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.2.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.3.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10" }, { "url": "https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3" }, { "url": "https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e" }, { "url": "https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca" }, { "url": "https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414" }, { "url": "https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23" }, { "url": "https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f" }, { "url": "https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b" } ], "title": "tracing: Unregister field variable histograms when the command fails", "x_generator": { "engine": "bippy-1.2.0" } } } }