CVE-2026-89746 is a vulnerability in Linux Kernel
Published on September 11, 2026
tracing: Fix use-after-free with same-name named triggers
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix use-after-free with same-name named triggers
When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named_data. Both are added to
tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(),
because save_hist_vars() is called before event_trigger_register() while
the named reuse is only detected later, in hist_register_trigger().
In the named-data branch hist_register_trigger() then frees the second
histogram's hist_data via destroy_hist_data(), but never removes its
tr->hist_vars list entry, leaving a dangling pointer and leaking the
trace_array reference it holds.
A later hist trigger that references a variable makes find_var_file()
walk tr->hist_vars and dereference the freed hist_data. The bug is
reproducible from userspace by writing three hist triggers to tracefs:
cd /sys/kernel/tracing
echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger
echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger
echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger
The third write panics the kernel:
BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290
Read of size 8 at addr ffff888001f8a0e0 by task sh/1
CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N
Call Trace:
find_var_file.part.0
find_event_var
parse_atom
parse_expr
__create_val_field
event_hist_trigger_parse
trigger_process_regex
event_trigger_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe
Allocated by task 1:
event_hist_trigger_parse
Freed by task 1:
hist_register_trigger+0x618/0xa30
event_hist_trigger_parse
The buggy address belongs to freed 2048-byte region
Oops: general protection fault ... RIP: find_var_file.part.0
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Fix by removing the hist_data from tr->hist_vars and releasing the
trace_array reference in the named-data branch of hist_register_trigger()
before freeing the hist_data.
Products Associated with CVE-2026-89746
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 435d2964af815aae456db554c62963b4515f19d0 and below 477d762be4b0ffaf01429ccd88859e93b0ec28cc is affected.
- Version 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e and below b1a49c22de01faf176d44e5caa765e237353a579 is affected.
- Version 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e and below 83d1ae0406d8eade219a81b401e201702dd9dc55 is affected.
- Version 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e and below a7318172aa332a161fb9618286e64454c827f8fd is affected.
- Version 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 is affected.
- Version 43b254d46c740bf9dbe65709afa021dd726dfa99 is affected.
- Version f1ae50cfb818ce1ac7a674406dfadb7653e2552d is affected.
- Version 6.12.18 and below 6.12.109 is affected.
- Version 6.1.130 and below 6.2 is affected.
- Version 6.6.81 and below 6.7 is affected.
- Version 6.13.6 and below 6.14 is affected.
- Version 6.14 is affected.
- Before 6.14 is unaffected.
- Version 6.12.109, <= 6.12.* is unaffected.
- Version 6.18.50, <= 6.18.* is unaffected.
- Version 7.2.4, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.