---
id: CVE-2026-97919
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Take the reference before publishing the named histogram trigger

  event_hist_trigger_named_init() puts the trigger on the global
  named_triggers list and only t…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Take the reference before publishing the named histogram trigger

  event_hist_trigger_named_init() puts the trigger on the global
  named_triggers list and only t…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd <
    b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8
  - >-
    Linux >= 7ab0fc61ce73040f89b12d76a8279995ec283541 <
    2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b
  - >-
    Linux >= 7ab0fc61ce73040f89b12d76a8279995ec283541 <
    91c15cdda6033e2439f5975b938754152f3d6e38
  - >-
    Linux >= 7ab0fc61ce73040f89b12d76a8279995ec283541 <
    0fe23b8eaba0d3372c66b7b31204408da0715edc
  - Linux ac7ab38c271ba2edaeb0dc35b200ec13339776ae
  - Linux 740dab2338f70d93aa8235db5a9541d846d7b21c
  - Linux >= 6.12.34 < 6.12.112
  - Linux >= 6.6.94 < 6.7
  - Linux >= 6.15.3 < 6.16
  - Linux 6.16
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:09.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97919'
references:
  - url: 'https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97919.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97919'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541145'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97919'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97919'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97919.mbox
  - url: 'https://git.kernel.org/stable/c/e5c5dad169fb569161d3eed6c3f6a59e65db1830'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10586
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.890Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Take the reference before publishing the named histogram trigger

event_hist_trigger_named_init() puts the trigger on the global
named_triggers list and only then takes the reference on the trigger it
shares its histogram with:

	data->ref++;

	save_named_trigger(data->named_data->name, data);

	ret = event_hist_trigger_init(data->named_data);
	if (ret < 0) {
		kfree(data->cmd_ops);
		data->cmd_ops = &trigger_hist_cmd;
	}

	return ret;

event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and
nothing takes the trigger back off the list on the way out.
event_hist_trigger_parse() frees it, and the next lookup by name reads the
freed object:

 BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0
 Read of size 8 at addr ffff888009346860 by task init/1
  find_named_trigger+0xac/0xc0
  hist_register_trigger+0xc1/0xa00
  event_hist_trigger_parse+0x3146/0x6af0
  event_trigger_write+0xce/0x160
 Freed by task 67:
  kfree+0x154/0x420
  trigger_kthread_fn+0xfd/0x160

Do the reference first and publish once it has succeeded, so that nothing
which can fail runs after the trigger becomes findable.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97919.json)