Linux Kernel: Unregister Field-Var Histograms on Command Failure
CVE-2026-99234 Published on November 2, 2026
tracing: Unregister field variable histograms when the command fails
In the Linux kernel, the following vulnerability has been resolved:
tracing: Unregister field variable histograms when the command fails
An action that names a field on another event needs that field as a
variable, so create_field_var_hist() registers a second hist trigger on
that event to provide it, and records it in
target_hist_data->field_var_hists[].
If a later part of the same command fails, create_actions() returns an
error and event_hist_trigger_parse() jumps to out_free. The write fails
with -EINVAL and sched_switch gets no trigger, but:
# echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \
events/sched/sched_waking/trigger
# echo 'my_synth u64 lat; int a; int b' >> synthetic_events
# echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\
onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\
>> events/sched/sched_switch/trigger
# cat events/sched/sched_waking/trigger
hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]
hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]
The second histogram is the one created for 'prio'. It is still active and
still counting.
out_free reaches destroy_field_var_hists(), which frees the
field_var_hists[] entries, but never unregister_field_var_hists(), which is
what removes the triggers and runs only from event_hist_trigger_free(). The
entry is freed and the trigger is left with nothing tracking it.
Unregister the field variable histograms in out_free as well, and record
each one as soon as its trigger is registered rather than after the lookup
that follows it, so no exit can leave a registered trigger untracked. The
entry then belongs to field_var_hists[] and is released by
destroy_field_var_hists(), so freeing it on that exit would be a double
free.
Products Associated with CVE-2026-99234
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below f21351d1c4cdcc6a68f03636a407c2af1a5e1e10 is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below dba0f492703956801149cc70b39d2650a37995c3 is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below a3d7ffd2409700748a495b645948fef48199206e is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below aae0ccd7326eef78dcdefffef3d1253e6f0615ca is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below 8482ec5b65f606d5bbcec518e0afc69ad65ca414 is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below 431959fc76456cbba539279fe8967aa9391e6f23 is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below 5afb9317e2eeb1c7021a82995ce244fda5a4bd4f is affected.
- Version 02205a6752f223779a1b0e9e8ffacbea6e717851 and below d0090baf02dd08f6e909f36f0ad54a4e80f5e79b is affected.
- Version 4.17 is affected.
- Before 4.17 is unaffected.
- Version 5.10.273, <= 5.10.* is unaffected.
- Version 5.15.224, <= 5.15.* is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.