---
id: CVE-2026-97935
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Set the trace clock before registering the histogram trigger

  hist_register_trigger() puts the trigger on the global named_triggers
  list in cmd_ops->init(), an…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Set the trace clock before registering the histogram trigger

  hist_register_trigger() puts the trigger on the global named_triggers
  list in cmd_ops->init(), an…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-825
  - CWE-416
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a4072fe85ba3671720cab0788291af953db27318 <
    cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad
  - >-
    Linux >= a4072fe85ba3671720cab0788291af953db27318 <
    cfad128171f8e2237a3c723d6478ef2cfb3b9127
  - >-
    Linux >= a4072fe85ba3671720cab0788291af953db27318 <
    65d1e28198f344832a8a63e8ccf84b8f65b92a32
  - >-
    Linux >= a4072fe85ba3671720cab0788291af953db27318 <
    6ede78d0563a2a3ae3e46f9c07cedb5d79645429
  - Linux 4.17
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:19.153'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97935'
references:
  - url: 'https://git.kernel.org/stable/c/65d1e28198f344832a8a63e8ccf84b8f65b92a32'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6ede78d0563a2a3ae3e46f9c07cedb5d79645429'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfad128171f8e2237a3c723d6478ef2cfb3b9127'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97935.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97935'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541269'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97935'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97935'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97935.mbox
  - url: 'https://git.kernel.org/stable/c/578d39ab420b18b76a12fc8d0573ec041a84da28'
  - url: 'https://kernelcve.org/list/?q=CVE-2026-97935'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.06155
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.885Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Set the trace clock before registering the histogram trigger

hist_register_trigger() puts the trigger on the global named_triggers
list in cmd_ops->init(), and only then sets the trace clock:

	if (data->cmd_ops->init) {
		ret = data->cmd_ops->init(data);
		if (ret < 0)
			goto out;
	}

	if (hist_data->enable_timestamps) {
		ret = tracing_set_clock(file->tr, hist_data->attrs->clock);
		if (ret) {
			hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));
			goto out;
		}

The clock string is not checked anywhere before that call, so a named
trigger using common_timestamp with an unknown clock fails after it has
already become findable. event_hist_trigger_parse() then frees it
without taking it off the list, and the next lookup by name reads the
freed object:

 ~# cd /sys/kernel/tracing/events/sched/sched_switch
 ~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger
 bash: echo: write error: Invalid argument
 ~# echo 'hist:name=foo:keys=common_pid' > trigger

  BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0
  Read of size 8 at addr ffff88800915d760 by task init/1
   find_named_trigger+0xac/0xc0
   hist_register_trigger+0xc1/0x900
   event_hist_trigger_parse+0x3146/0x6af0
   event_trigger_write+0xce/0x160
  Freed by task 63:
   kfree+0x154/0x420
   trigger_kthread_fn+0xfd/0x160

Set the clock before the trigger is registered, so that nothing which
can fail runs after it is published, the way commit 6f86bdeab633
("tracing: Fix bad hist from corrupting named_triggers list") moved the
registration below the rest of the setup.

tracing_set_filter_buffering() is reference counted, so the init failure
path has to drop the reference that the clock block now takes first.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97935.json)