{"id":"CVE-2026-99234","revision":"9e49b857a72749e687edb01bc82edf07","records":[{"revision":"9e49b857a72749e687edb01bc82edf07","observedAt":"2026-11-02T17:57:17.012+00:00","statement":{"source":"cve-program","id":"CVE-2026-99234","aliases":[],"title":"tracing: Unregister field variable histograms when the command fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n  # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n      events/sched/sched_waking/trigger\n  # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n      onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n      >> events/sched/sched_switch/trigger\n  # cat events/sched/sched_waking/trigger\n  hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n  hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree.","state":0,"publishedAt":"2026-11-02T16:06:41.083+00:00","modifiedAt":"2026-11-02T16:06:41.083+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"f21351d1c4cdcc6a68f03636a407c2af1a5e1e10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"dba0f492703956801149cc70b39d2650a37995c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"a3d7ffd2409700748a495b645948fef48199206e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"aae0ccd7326eef78dcdefffef3d1253e6f0615ca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"8482ec5b65f606d5bbcec518e0afc69ad65ca414\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"431959fc76456cbba539279fe8967aa9391e6f23\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"5afb9317e2eeb1c7021a82995ce244fda5a4bd4f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"02205a6752f223779a1b0e9e8ffacbea6e717851\",\n                            \"lessThan\": \"d0090baf02dd08f6e909f36f0ad54a4e80f5e79b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.273\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.224\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.60\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.14\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3.1\",\n                            \"lessThanOrEqual\": \"7.3.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10","https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3","https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e","https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca","https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414","https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23","https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f","https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99234","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99234","identifiers":["CVE-2026-99234"]},"retained":false,"historicalAffected":[]}],"coverage":[]}