CVE-2026-89746

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same

name=, the second one reuses the first as named_data. Both are added to

tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(),

because save_hist_vars() is called before event_trigger_register() while

the named reuse is only detected later, in hist_register_trigger().

In the named-data branch hist_register_trigger() then frees the second

histogram's hist_data via destroy_hist_data(), but never removes its

tr->hist_vars list entry, leaving a dangling pointer and leaking the

trace_array reference it holds.

A later hist trigger that references a variable makes find_var_file()

walk tr->hist_vars and dereference the freed hist_data. The bug is

reproducible from userspace by writing three hist triggers to tracefs:

cd /sys/kernel/tracing

echo 'hist:keys=common_pid:x=common_p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References