CVE-2026-97918

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Undo the registration when enabling the histogram trigger fails

Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers

list") described how a trigger that is registered but not on file->triggers

ends up freed while still on the global named_triggers list, and moved the

registration down so that hist_trigger_enable() follows it immediately. One

path still gets there. hist_trigger_enable() adds the trigger and takes it

straight back out when the event cannot be enabled:

list_add_tail_rcu(&data->list, &file->triggers);

update_cond_flag(file);

if (trace_event_trigger_enable_disable(file, 1) < 0) {

list_del_rcu(&data->list);

update_cond_flag(file);

ret--;

}

so the list walk in hist_unregister_trigger() matches nothing, test stays

NULL, and the ->free() that would call del_named_trigger() is skipped.

out_unreg falls through to out_free, which frees the trigger anyway:

BUG: KASAN

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References