CVE-2026-89746 - Vulnerability Details

- tracing: Fix use-after-free with same-name named triggers

Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named_data. Both are added to
tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(),
because save_hist_vars() is called before event_trigger_register() while
the named reuse is only detected later, in hist_register_trigger().

In the named-data branch hist_register_trigger() then frees the second
histogram's hist_data via destroy_hist_data(), but never removes its
tr->hist_vars list entry, leaving a dangling pointer and leaking the
trace_array reference it holds.

A later hist trigger that references a variable makes find_var_file()
walk tr->hist_vars and dereference the freed hist_data. The bug is
reproducible from userspace by writing three hist triggers to tracefs:

cd /sys/kernel/tracing
echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger
echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger
echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger

The third write panics the kernel:

BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290
Read of size 8 at addr ffff888001f8a0e0 by task sh/1
CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N
Call Trace:
find_var_file.part.0
find_event_var
parse_atom
parse_expr
__create_val_field
event_hist_trigger_parse
trigger_process_regex
event_trigger_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe
Allocated by task 1:
event_hist_trigger_parse
Freed by task 1:
hist_register_trigger+0x618/0xa30
event_hist_trigger_parse
The buggy address belongs to freed 2048-byte region
Oops: general protection fault ... RIP: find_var_file.part.0
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Fix by removing the hist_data from tr->hist_vars and releasing the
trace_array reference in the named-data branch of hist_register_trigger()
before freeing the hist_data.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel bug is a use–after–free that occurs when two histogram triggers with the second trigger frees its data structure but leaves a dangling list entry, so that a subsequent trigger that references the freed data causes the kernel to dereference an invalid pointer. The result is a KASAN crash and a subsequent kernel panic, effectively bringing the system down. The weakness is classified as CWE–825.

Affected Systems

This issue affects the Linux kernel in any release prior to the inclusion of the fix that removes the stale hist_data entry and releases the trace_array reference. No specific versions are listed, so any kernel that has not yet applied the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not in the CISA KEV catalog. It is inferred that the vulnerability requires a local account with write access to the /sys/kernel/tracing interface, which typically requires root. An attacker with that privilege could repeatedly crash the system, leading to a denial-of-service but not remote code execution or data theft.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77`	affected	< 441aa6742dff70297b5f64533a07a6189a026e91
`43b254d46c740bf9dbe65709afa021dd726dfa99`	affected	< 3a8534664426c071c2dfb5b4ffa36b18a2abfd79
`435d2964af815aae456db554c62963b4515f19d0`	affected	< 477d762be4b0ffaf01429ccd88859e93b0ec28cc
`6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e`	affected	< b1a49c22de01faf176d44e5caa765e237353a579
`6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e`	affected	< 83d1ae0406d8eade219a81b401e201702dd9dc55
`6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e`	affected	< a7318172aa332a161fb9618286e64454c827f8fd
`f1ae50cfb818ce1ac7a674406dfadb7653e2552d`	affected	—
`6.1.130`	affected	< 6.1.188
`6.6.81`	affected	< 6.6.157
`6.12.18`	affected	< 6.12.109
`6.13.6`	affected	< 6.14

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[435d2964af815aae456db554c62963b4515f19d0,477d762be4b0ffaf01429ccd88859e93b0ec28cc)`	affected	code_commit	—
`[6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e,b1a49c22de01faf176d44e5caa765e237353a579)`	affected	code_commit	—
`[6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e,83d1ae0406d8eade219a81b401e201702dd9dc55)`	affected	code_commit	—
`[6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e,a7318172aa332a161fb9618286e64454c827f8fd)`	affected	code_commit	—
`5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77`	affected	code_commit	—
`43b254d46c740bf9dbe65709afa021dd726dfa99`	affected	code_commit	—
`f1ae50cfb818ce1ac7a674406dfadb7653e2552d`	affected	code_commit	—
`[6.12.18,6.12.109)`	affected	semver	—
`[6.1.130,6.2.0)`	affected	semver	—
`[6.6.81,6.7.0)`	affected	semver	—
`[6.13.6,6.14.0)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.14`	affected	semver	—
`[0,6.14)`	unaffected	generic	—
`[6.12.109,6.13.0]`	unaffected	semver	—
`[6.18.50,6.19.0]`	unaffected	semver	—
`[7.2.4,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that incorporates the commit that removes the stale hist_data reference and releases the trace_array reference
If a kernel /sys/kernel/tracing system or prevent creation of new histogram triggers by adjusting the kernel’s tracing configuration
Periodically review the kernel for updates related to tracing use‑after‑free bugs

Generated by OpenCVE AI on September 15, 2026 at 19:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3a8534664426c071c2dfb5b4ffa36b18a2abfd79
https://git.kernel.org/stable/c/441aa6742dff70297b5f64533a07a6189a026e91
https://git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc
https://git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55
https://git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd
https://git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579
https://nvd.nist.gov/vuln/detail/CVE-2026-89746
https://www.cve.org/CVERecord?id=CVE-2026-89746

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3a8534664426c071c2dfb5b4ffa36b18a2abfd79 https://git.kernel.org/stable/c/441aa6742dff70297b5f64533a07a6189a026e91

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89746 https://www.cve.org/CVERecord?id=CVE-2026-89746
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.
Title		tracing: Fix use-after-free with same-name named triggers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc https://git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55 https://git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd https://git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:51.529Z

Updated: 2026-09-14T12:02:27.816Z

Reserved: 2026-09-11T19:38:34.762Z

Link: CVE-2026-89746

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:05.373

Modified: 2026-09-14T13:19:23.350

Link: CVE-2026-89746

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:51Z

Links: CVE-2026-89746 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T19:30:12Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object