CVE-2026-99140

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix hist trigger timestamps for buffered events

Syzkaller triggered a WARN ON ONCE(!nest) warning:

WARNING: kernel/trace/ring buffer.c:821 at ring buffer event time stamp Call trace: ring buffer event time stamp hist field timestamp hist fn call event hist trigger event triggers call event trigger test discard trace event buffer commit do trace event raw event sched switch trace event raw event sched switch

The warning is probabilistically reproducible and is related to syzkaller executing the following commands:

echo 'prev pid == 999999' > events/sched/sched switch/filter echo 'hist:keys=common timestamp' > events/sched/sched switch/trigger

The specific triggering process is as follows:

CPU 0 CPU 1 (context switching) (echo 'hist:keys=common timestamp' > events/sched/sched switch/trigger) do trace event raw event ##call trace event buffer lock reserve if (!tr->no filter buffering ref && trace file->flags & EVENT FILE FL FILTERED) return entry; // return directly event hist trigger parse hist register trigger tracing set filter buffering(file->tr, true); tr->no filter buffering ref++; trace buffer lock reserve rb start commit local inc(&cpu buffer->committing); // skipped and not executed trace event buffer commit event trigger test discard event triggers call event hist trigger hist fn call hist field timestamp ring buffer event time stamp nest = local read(&cpu buffer->committing); WARN ON ONCE(!nest) // trigger warning

The root cause is that when an event file has a filter attached and the hist trigger has not yet been attached, trace event buffer lock reserve() writes the event into the per-CPU trace buffered event temp buffer instead of reserving it in the ring buffer, so cpu buffer->committing is not incremented. When the event is later processed at commit time by a hist trigger, hist field timestamp() -> ring buffer event time stamp() sees a zero committing count, triggering WARN ON ONCE(!nest).

tracing event time stamp() was added by commit d8279bfc5e959 ("tracing: Add tracing event time stamp() API") for exactly this case: if the event is the per-CPU trace buffered event, it returns the current ring buffer timestamp. But it never gained a caller. Use it in hist field timestamp(), so that a hist trigger that races onto a buffered event records the current time, which is only marginally later than when the event was recorded, instead of warning and recording a bogus timestamp.