CVE-2026-97918

In the Linux kernel, the following vulnerability has been resolved:

tracing: Undo the registration when enabling the histogram trigger fails

Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled:

list_add_tail_rcu(&data->list, &file->triggers);

update_cond_flag(file);

if (trace_event_trigger_enable_disable(file, 1) < 0) {
	list_del_rcu(&data->list);
	update_cond_flag(file);
	ret--;
}

so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway:

BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160

Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference, the reference on the trigger a named histogram is shared with, and the copied cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(), whose sm_ref and buffered event reference are otherwise left behind.

Since ->free() releases trigger_data and, for a trigger that does not share its histogram, hist_data with it, out_unreg can no longer fall through to out_free. For a trigger that does share, hist_register_trigger() has already destroyed the caller's hist_data, so the fall-through was reading freed memory there as well.

Move the enable_timestamps check in hist_unregister_trigger() above the ->free() call for the same reason: hist_data does not outlive it once the trigger being removed is the one that owns it.

In the Linux kernel, the following vulnerability has been resolved:

tracing: Undo the registration when enabling the histogram trigger fails

Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled:

list_add_tail_rcu(&data->list, &file->triggers);

update_cond_flag(file);

if (trace_event_trigger_enable_disable(file, 1) < 0) {
	list_del_rcu(&data->list);
	update_cond_flag(file);
	ret--;
}

so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway:

BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160

Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference, the reference on the trigger a named histogram is shared with, and the copied cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(), whose sm_ref and buffered event reference are otherwise left behind.

Since ->free() releases trigger_data and, for a trigger that does not share its histogram, hist_data with it, out_unreg can no longer fall through to out_free. For a trigger that does share, hist_register_trigger() has already destroyed the caller's hist_data, so the fall-through was reading freed memory there as well.

Move the enable_timestamps check in hist_unregister_trigger() above the ->free() call for the same reason: hist_data does not outlive it once the trigger being removed is the one that owns it.

In the Linux kernel, the following vulnerability has been resolved:

tracing: Undo the registration when enabling the histogram trigger fails

Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled:

list_add_tail_rcu(&data->list, &file->triggers);

update_cond_flag(file);

if (trace_event_trigger_enable_disable(file, 1) < 0) {
	list_del_rcu(&data->list);
	update_cond_flag(file);
	ret--;
}

so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway:

BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160

Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference, the reference on the trigger a named histogram is shared with, and the copied cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(), whose sm_ref and buffered event reference are otherwise left behind.

Since ->free() releases trigger_data and, for a trigger that does not share its histogram, hist_data with it, out_unreg can no longer fall through to out_free. For a trigger that does share, hist_register_trigger() has already destroyed the caller's hist_data, so the fall-through was reading freed memory there as well.

Move the enable_timestamps check in hist_unregister_trigger() above the ->free() call for the same reason: hist_data does not outlive it once the trigger being removed is the one that owns it.

In the Linux kernel, the following vulnerability has been resolved:

tracing: Undo the registration when enabling the histogram trigger fails

Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled:

list_add_tail_rcu(&data->list, &file->triggers);

update_cond_flag(file);

if (trace_event_trigger_enable_disable(file, 1) < 0) {
	list_del_rcu(&data->list);
	update_cond_flag(file);
	ret--;
}

so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway:

BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160

Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference, the reference on the trigger a named histogram is shared with, and the copied cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(), whose sm_ref and buffered event reference are otherwise left behind.

Since ->free() releases trigger_data and, for a trigger that does not share its histogram, hist_data with it, out_unreg can no longer fall through to out_free. For a trigger that does share, hist_register_trigger() has already destroyed the caller's hist_data, so the fall-through was reading freed memory there as well.

Move the enable_timestamps check in hist_unregister_trigger() above the ->free() call for the same reason: hist_data does not outlive it once the trigger being removed is the one that owns it.

In the Linux kernel, the following vulnerability has been resolved:

tracing: Undo the registration when enabling the histogram trigger fails

Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled:

list_add_tail_rcu(&data->list, &file->triggers);

update_cond_flag(file);

if (trace_event_trigger_enable_disable(file, 1) < 0) {
	list_del_rcu(&data->list);
	update_cond_flag(file);
	ret--;
}

so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway:

BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160

Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference, the reference on the trigger a named histogram is shared with, and the copied cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(), whose sm_ref and buffered event reference are otherwise left behind.

Since ->free() releases trigger_data and, for a trigger that does not share its histogram, hist_data with it, out_unreg can no longer fall through to out_free. For a trigger that does share, hist_register_trigger() has already destroyed the caller's hist_data, so the fall-through was reading freed memory there as well.

Move the enable_timestamps check in hist_unregister_trigger() above the ->free() call for the same reason: hist_data does not outlive it once the trigger being removed is the one that owns it.

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545}
• seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840}
• i3c: master: svc: bound IBI payload to the requested max_payload_len {CVE-2026-80951}
• i3c: master: svc: Use readsb helper for reading MDB {CVE-2026-80951}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access {CVE-2026-98365}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• drm/virtio: use uninterruptible resv lock for plane updates {CVE-2026-64098}
• keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823}
• exfat: fix potential use-after-free in exfat_find_dir_entry() {CVE-2026-63808}
• ethtool: cmis: require exact CDB reply length {CVE-2026-63996}
• tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 {CVE-2026-63994}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• bpf: Validate BTF repeated field counts before expansion {CVE-2026-64354}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• ALSA: seq: Serialize UMP output teardown with event_input {CVE-2026-64029}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993}
• tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992}
• vsock/virtio: bind uarg before filling zerocopy skb {CVE-2026-63970}
• KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() {CVE-2026-64555}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• crypto: af_alg - zero initialize memory allocated via sock_kmalloc {CVE-2025-71113}
• mailbox: mailbox-test: don't free the reused channel {CVE-2026-53294}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• nfsd: release layout stid on setlease failure {CVE-2026-53399}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• blk-mq: pop cached request if it is usable {CVE-2026-64017}
• scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}
• posix-cpu-timers: Prevent UAF caused by non-leader exec() race {CVE-2026-64560}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268}
• Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sched/core: Make core-sched flips wait for in-flight selections {CVE-2026-89520}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• NFSD: Prevent client use-after-free during delegation revoke…