CVE-2026-99234

In the Linux kernel, the following vulnerability has been resolved:

tracing: Unregister field variable histograms when the command fails

An action that names a field on another event needs that field as a variable, so create field var hist() registers a second hist trigger on that event to provide it, and records it in target hist data->field var hists[].

If a later part of the same command fails, create actions() returns an error and event hist trigger parse() jumps to out free. The write fails with -EINVAL and sched switch gets no trigger, but:

events/sched/sched waking/trigger

onmatch(sched.sched waking).my synth($wakeup lat,prio,nosuchfld)'

hist:keys=pid:vals=hitcount:ts0=common timestamp.usecs:sort=hitcount:size=2048:clock=global [active] hist:keys=pid:vals=hitcount:synthetic prio=prio:sort=hitcount:size=2048 [active]

The second histogram is the one created for 'prio'. It is still active and still counting.

out free reaches destroy field var hists(), which frees the field var hists[] entries, but never unregister field var hists(), which is what removes the triggers and runs only from event hist trigger free(). The entry is freed and the trigger is left with nothing tracking it.

Unregister the field variable histograms in out free as well, and record each one as soon as its trigger is registered rather than after the lookup that follows it, so no exit can leave a registered trigger untracked. The entry then belongs to field var hists[] and is released by destroy field var hists(), so freeing it on that exit would be a double free.