--- id: CVE-2026-89746 title: 'tracing: Fix use-after-free with same-name named triggers' summary: |- In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the firs… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: cna cwe: - CWE-825 vendor: Linux product: Linux affected: - >- Linux >= 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 < 441aa6742dff70297b5f64533a07a6189a026e91 - >- Linux >= 43b254d46c740bf9dbe65709afa021dd726dfa99 < 3a8534664426c071c2dfb5b4ffa36b18a2abfd79 - >- Linux >= 435d2964af815aae456db554c62963b4515f19d0 < 477d762be4b0ffaf01429ccd88859e93b0ec28cc - >- Linux >= 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e < b1a49c22de01faf176d44e5caa765e237353a579 - >- Linux >= 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e < 83d1ae0406d8eade219a81b401e201702dd9dc55 - >- Linux >= 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e < a7318172aa332a161fb9618286e64454c827f8fd - Linux f1ae50cfb818ce1ac7a674406dfadb7653e2552d - Linux >= 6.1.130 < 6.1.188 - Linux >= 6.6.81 < 6.6.157 - Linux >= 6.12.18 < 6.12.109 - Linux >= 6.13.6 < 6.14 - Linux 6.14 published: '2026-09-11' updated: '2026-10-19' sourceUpdated: '2026-10-19T08:52:00.175Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89746' references: - url: 'https://git.kernel.org/stable/c/441aa6742dff70297b5f64533a07a6189a026e91' - url: 'https://git.kernel.org/stable/c/3a8534664426c071c2dfb5b4ffa36b18a2abfd79' - url: 'https://git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc' - url: 'https://git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579' - url: 'https://git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55' - url: 'https://git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89746.json - url: 'https://access.redhat.com/security/cve/CVE-2026-89746' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532209' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89746' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89746' - url: >- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89746.mbox tags: - cve.org - csaf - vex - red-hat epss: 0.00164 epssPercentile: 0.05553 scores: cna: 7.8 vendor: 7 ingestedAt: '2026-09-14T15:23:07.449Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data. ## Affected - `Linux >= 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 < 441aa6742dff70297b5f64533a07a6189a026e91` - `Linux >= 43b254d46c740bf9dbe65709afa021dd726dfa99 < 3a8534664426c071c2dfb5b4ffa36b18a2abfd79` - `Linux >= 435d2964af815aae456db554c62963b4515f19d0 < 477d762be4b0ffaf01429ccd88859e93b0ec28cc` - `Linux >= 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e < b1a49c22de01faf176d44e5caa765e237353a579` - `Linux >= 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e < 83d1ae0406d8eade219a81b401e201702dd9dc55` - `Linux >= 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e < a7318172aa332a161fb9618286e64454c827f8fd` - `Linux f1ae50cfb818ce1ac7a674406dfadb7653e2552d` - `Linux >= 6.1.130 < 6.1.188` - `Linux >= 6.6.81 < 6.6.157` - `Linux >= 6.12.18 < 6.12.109` - `Linux >= 6.13.6 < 6.14` - `Linux 6.14` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89746.json)