CVE-2026-97935tracing: Set the trace clock before registering the histogram trigger

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger hist_register_trigger() puts the trigger on the global named_triggers list in cmd_ops->init(), and only then sets the trace clock: if (data->cmd_ops->init) { ret = data->cmd_ops->init(data); if (ret < 0) goto out; } if (hist_data->enable_timestamps) { ret = tracing_set_clock(file->tr, hist_data->attrs->clock); if (ret) { hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock)); goto out; } The clock string is not checked anywhere before that call, so a named trigger using common_timestamp with an unknown clock fails after it has already become findable. event_hist_trigger_parse() then frees it without taking it off the list, and the next lookup by name reads the freed object: ~# cd /sys/kernel/tracing/events/sched/sched_switch ~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=foo:keys=common_pid' > trigger BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff88800915d760 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0x900 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 63: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Set the clock before the trigger is registered, so that nothing which can fail runs after it is published, the way commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") moved the registration below the rest of the setup. tracing_set_filter_buffering() is reference counted, so the init failure path has to drop the reference that the clock block now takes first.

Timeline

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.

EPSS (exploitation in 30 days)

0.18% · top 93% of all CVEs (13 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

• Linux · Linux

  • affected a4072fe85ba3671720cab0788291af953db27318 – < 85e6df6e9cd489de8e238596a68b89eee0c03b88
  • affected a4072fe85ba3671720cab0788291af953db27318 – < 3568dabef3fb56517777ab981584f72ab1e90186
  • affected a4072fe85ba3671720cab0788291af953db27318 – < c7b77c22adcf314ec8aa4807f01914dcbc62ed54
  • affected a4072fe85ba3671720cab0788291af953db27318 – < 578d39ab420b18b76a12fc8d0573ec041a84da28
  • affected a4072fe85ba3671720cab0788291af953db27318 – < cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad
  • affected a4072fe85ba3671720cab0788291af953db27318 – < cfad128171f8e2237a3c723d6478ef2cfb3b9127
  • affected a4072fe85ba3671720cab0788291af953db27318 – < 65d1e28198f344832a8a63e8ccf84b8f65b92a32
  • affected a4072fe85ba3671720cab0788291af953db27318 – < 6ede78d0563a2a3ae3e46f9c07cedb5d79645429

• Linux · Linux

  • affected 4.17
  • unaffected < 4.17
  • unaffected 5.10.273 – ≤ 5.10.*
  • unaffected 5.15.224 – ≤ 5.15.*
  • unaffected 6.1.191 – ≤ 6.1.*
  • unaffected 6.6.160 – ≤ 6.6.*
  • unaffected 6.12.112 – ≤ 6.12.*
  • unaffected 6.18.53 – ≤ 6.18.*
  • unaffected 7.2.7 – ≤ 7.2.*
  • unaffected 7.3 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-86789 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-97935](https://cveledger.app/badge/CVE-2026-97935.svg)](https://cveledger.app/cve/CVE-2026-97935)

Record last updated 30 Oct 2026, 12:37 UTC.