CVE-2026-97919

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97919", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.202Z", "datePublished": "2026-09-25T10:22:39.829Z", "dateUpdated": "2026-10-21T12:53:38.904Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:38.904Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take the reference before publishing the named histogram trigger\n\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\n\n\tdata->ref++;\n\n\tsave_named_trigger(data->named_data->name, data);\n\n\tret = event_hist_trigger_init(data->named_data);\n\tif (ret < 0) {\n\t\tkfree(data->cmd_ops);\n\t\tdata->cmd_ops = &trigger_hist_cmd;\n\t}\n\n\treturn ret;\n\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff888009346860 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 67:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_hist.c"], "versions": [{"version": "ac7ab38c271ba2edaeb0dc35b200ec13339776ae", "lessThan": "e5c5dad169fb569161d3eed6c3f6a59e65db1830", "status": "affected", "versionType": "git"}, {"version": "e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd", "lessThan": "b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8", "status": "affected", "versionType": "git"}, {"version": "7ab0fc61ce73040f89b12d76a8279995ec283541", "lessThan": "2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b", "status": "affected", "versionType": "git"}, {"version": "7ab0fc61ce73040f89b12d76a8279995ec283541", "lessThan": "91c15cdda6033e2439f5975b938754152f3d6e38", "status": "affected", "versionType": "git"}, {"version": "7ab0fc61ce73040f89b12d76a8279995ec283541", "lessThan": "0fe23b8eaba0d3372c66b7b31204408da0715edc", "status": "affected", "versionType": "git"}, {"version": "740dab2338f70d93aa8235db5a9541d846d7b21c", "status": "affected", "versionType": "git"}, {"version": "6.6.94", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.34", "lessThan": "6.12.112", "status": "affected", "versionType": "semver"}, {"version": "6.15.3", "lessThan": "6.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_hist.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.94", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.34", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e5c5dad169fb569161d3eed6c3f6a59e65db1830"}, {"url": "https://git.kernel.org/stable/c/b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8"}, {"url": "https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b"}, {"url": "https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38"}, {"url": "https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc"}], "title": "tracing: Take the reference before publishing the named histogram trigger", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_hist.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e5c5dad169fb569161d3eed6c3f6a59e65db1830", "status": "affected", "version": "ac7ab38c271ba2edaeb0dc35b200ec13339776ae", "versionType": "git"}, {"lessThan": "b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8", "status": "affected", "version": "e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd", "versionType": "git"}, {"lessThan": "2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b", "status": "affected", "version": "7ab0fc61ce73040f89b12d76a8279995ec283541", "versionType": "git"}, {"lessThan": "91c15cdda6033e2439f5975b938754152f3d6e38", "status": "affected", "version": "7ab0fc61ce73040f89b12d76a8279995ec283541", "versionType": "git"}, {"lessThan": "0fe23b8eaba0d3372c66b7b31204408da0715edc", "status": "affected", "version": "7ab0fc61ce73040f89b12d76a8279995ec283541", "versionType": "git"}, {"status": "affected", "version": "740dab2338f70d93aa8235db5a9541d846d7b21c", "versionType": "git"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.94", "versionType": "semver"}, {"lessThan": "6.12.112", "status": "affected", "version": "6.12.34", "versionType": "semver"}, {"lessThan": "6.16", "status": "affected", "version": "6.15.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_hist.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take the reference before publishing the named histogram trigger\n\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\n\n\tdata->ref++;\n\n\tsave_named_trigger(data->named_data->name, data);\n\n\tret = event_hist_trigger_init(data->named_data);\n\tif (ret < 0) {\n\t\tkfree(data->cmd_ops);\n\t\tdata->cmd_ops = &trigger_hist_cmd;\n\t}\n\n\treturn ret;\n\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff888009346860 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 67:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable."}], "id": "CVE-2026-97919", "lastModified": "2026-10-21T13:21:16.177", "metrics": {}, "published": "2026-09-25T11:17:18.923", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5c5dad169fb569161d3eed6c3f6a59e65db1830"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tracing: Take the reference before publishing the named histogram trigger", "id": "2541145", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541145"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntracing: Take the reference before publishing the named histogram trigger\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\ndata->ref++;\nsave_named_trigger(data->named_data->name, data);\nret = event_hist_trigger_init(data->named_data);\nif (ret < 0) {\nkfree(data->cmd_ops);\ndata->cmd_ops = &trigger_hist_cmd;\n}\nreturn ret;\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\nBUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\nRead of size 8 at addr ffff888009346860 by task init/1\nfind_named_trigger+0xac/0xc0\nhist_register_trigger+0xc1/0xa00\nevent_hist_trigger_parse+0x3146/0x6af0\nevent_trigger_write+0xce/0x160\nFreed by task 67:\nkfree+0x154/0x420\ntrigger_kthread_fn+0xfd/0x160\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable.", "A flaw was found in the Linux kernel's tracing subsystem. When creating a named histogram trigger, the kernel registers the trigger before completing its setup. If initialization fails, the object is freed without being removed from the global tracking list. A local attacker can exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially memory corruption by triggering a use-after-free condition, where the kernel accesses previously released memory."], "name": "CVE-2026-97919", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97919\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97919\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97919.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab0fc61ce73040f89b12d76a8279995ec283541,2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab0fc61ce73040f89b12d76a8279995ec283541,91c15cdda6033e2439f5975b938754152f3d6e38)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7ab0fc61ce73040f89b12d76a8279995ec283541,0fe23b8eaba0d3372c66b7b31204408da0715edc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ac7ab38c271ba2edaeb0dc35b200ec13339776ae"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "740dab2338f70d93aa8235db5a9541d846d7b21c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.94,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.34,6.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.15.3,6.16)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:45:17.526363+00:00", "updated": "2026-10-01T05:45:17.050479+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}