CVE-2026-97936

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix memory corruption from the histogram stacktrace modifier

parse_field() sets HIST_FIELD_FL_STACKTRACE from the ".stacktrace"

modifier before it looks the field name up, and nothing afterwards

checks that the name resolved to a field which holds a stacktrace.

create_hist_field() picks HIST_FIELD_FN_STACK on the strength of the

field pointer alone, which reads a __data_loc word from the record and

follows its low 16 bits as an offset into the same record.

event_hist_trigger() takes the first word there as an entry count and

copies that many longs into a 31 entry array:

n_entries = *stack;

memcpy(entries, ++stack, n_entries * sizeof(unsigned long));

Neither end of that copy is bounded, and the count is whatever the event

holds at the offset, so any field will do:

# cd /sys/kernel/tracing/events/sched/sched_process_fork

# echo 'hist:keys=parent_pid.stacktrace' > trigger

# (true)

BUG: kernel NULL

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References