---
id: CVE-2026-97919
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Take the reference before publishing the named histogram trigger

  event_hist_trigger_named_init() puts the trigger on the global
  named_triggers list and only t…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Take the reference before publishing the named histogram trigger

  event_hist_trigger_named_init() puts the trigger on the global
  named_triggers list and only t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7ab0fc61ce73040f89b12d76a8279995ec283541 <
    2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b
  - >-
    Linux >= 7ab0fc61ce73040f89b12d76a8279995ec283541 <
    91c15cdda6033e2439f5975b938754152f3d6e38
  - >-
    Linux >= 7ab0fc61ce73040f89b12d76a8279995ec283541 <
    0fe23b8eaba0d3372c66b7b31204408da0715edc
  - Linux ac7ab38c271ba2edaeb0dc35b200ec13339776ae
  - Linux e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd
  - Linux 740dab2338f70d93aa8235db5a9541d846d7b21c
  - Linux >= 6.6.94 < 6.7
  - Linux >= 6.12.34 < 6.13
  - Linux >= 6.15.3 < 6.16
  - Linux 6.16
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:18.923'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97919'
references:
  - url: 'https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.890Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Take the reference before publishing the named histogram trigger

event_hist_trigger_named_init() puts the trigger on the global
named_triggers list and only then takes the reference on the trigger it
shares its histogram with:

	data->ref++;

	save_named_trigger(data->named_data->name, data);

	ret = event_hist_trigger_init(data->named_data);
	if (ret < 0) {
		kfree(data->cmd_ops);
		data->cmd_ops = &trigger_hist_cmd;
	}

	return ret;

event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and
nothing takes the trigger back off the list on the way out.
event_hist_trigger_parse() frees it, and the next lookup by name reads the
freed object:

 BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0
 Read of size 8 at addr ffff888009346860 by task init/1
  find_named_trigger+0xac/0xc0
  hist_register_trigger+0xc1/0xa00
  event_hist_trigger_parse+0x3146/0x6af0
  event_trigger_write+0xce/0x160
 Freed by task 67:
  kfree+0x154/0x420
  trigger_kthread_fn+0xfd/0x160

Do the reference first and publish once it has succeeded, so that nothing
which can fail runs after the trigger becomes findable.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.