GHSA-6VF7-PXHP-XPJV
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31In the Linux kernel, the following vulnerability has been resolved:
tracing: Take the reference before publishing the named histogram trigger
event_hist_trigger_named_init() puts the trigger on the global named_triggers list and only then takes the reference on the trigger it shares its histogram with:
data->ref++;
save_named_trigger(data->named_data->name, data);
ret = event_hist_trigger_init(data->named_data);
if (ret < 0) {
kfree(data->cmd_ops);
data->cmd_ops = &trigger_hist_cmd;
}
return ret;
event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and nothing takes the trigger back off the list on the way out. event_hist_trigger_parse() frees it, and the next lookup by name reads the freed object:
BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff888009346860 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 67: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160
Do the reference first and publish once it has succeeded, so that nothing which can fail runs after the trigger becomes findable.
{
"affected": [],
"aliases": [
"CVE-2026-97919"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:18Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take the reference before publishing the named histogram trigger\n\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\n\n\tdata-\u003eref++;\n\n\tsave_named_trigger(data-\u003enamed_data-\u003ename, data);\n\n\tret = event_hist_trigger_init(data-\u003enamed_data);\n\tif (ret \u003c 0) {\n\t\tkfree(data-\u003ecmd_ops);\n\t\tdata-\u003ecmd_ops = \u0026trigger_hist_cmd;\n\t}\n\n\treturn ret;\n\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff888009346860 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 67:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable.",
"id": "GHSA-6vf7-pxhp-xpjv",
"modified": "2026-09-25T12:31:28Z",
"published": "2026-09-25T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97919"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.