CVE-2026-97923

In the Linux kernel, the following vulnerability has been resolved:

tracing: Free histogram the var ref when its initialization fails

create var ref() allocates a VAR REF hist field and then calls init var ref() to fill it in. When that fails the field is leaked.

commit 656fe2ba85e8 ("tracing: Use hist trigger's var ref array to destroy var refs") made destroy hist field() return early for HIST FIELD FL VAR REF, since var refs are freed by walking the trigger's var refs[] array instead. create var ref() adds the field to that array only after init var ref() has succeeded, so on this path the field is in neither place and nothing frees it. The call was correct when it was written, before var refs were taken out of destroy hist field().

init var ref() cannot free it either. The caller owns the field, so init var ref() undoes only its own string allocations and leaves the field alone. Freeing it there would leave create var ref() passing freed memory to destroy hist field(), which reads its flags.

Call destroy hist field(), which frees the field without consulting the flag.