CVE-2026-89746

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same name=, the second one reuses the first as named data. Both are added to tr->hist vars by save hist vars() during event hist trigger parse(), because save hist vars() is called before event trigger register() while the named reuse is only detected later, in hist register trigger().

In the named-data branch hist register trigger() then frees the second histogram's hist data via destroy hist data(), but never removes its tr->hist vars list entry, leaving a dangling pointer and leaking the trace array reference it holds.

A later hist trigger that references a variable makes find var file() walk tr->hist vars and dereference the freed hist data. The bug is reproducible from userspace by writing three hist triggers to tracefs:

cd /sys/kernel/tracing echo 'hist:keys=common pid:x=common pid:name=mh' > events/sched/sched switch/trigger echo 'hist:keys=common pid:x=common pid:name=mh' > events/sched/sched process fork/trigger echo 'hist:keys=common pid:vals=$x' > events/sched/sched process exit/trigger

The third write panics the kernel:

BUG: KASAN: slab-use-after-free in find var file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find var file.part.0 find event var parse atom parse expr create val field event hist trigger parse trigger process regex event trigger write vfs write ksys write do syscall 64 entry SYSCALL 64 after hwframe Allocated by task 1: event hist trigger parse Freed by task 1: hist register trigger+0x618/0xa30 event hist trigger parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find var file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Fix by removing the hist data from tr->hist vars and releasing the trace array reference in the named-data branch of hist register trigger() before freeing the hist data.