CVE-2026-89746

A flaw was found in the Linux kernel's tracing component. A local user can exploit a use-after-free vulnerability by registering multiple histogram triggers with the same name. This action causes the kernel to attempt to access freed memory, leading to a system crash and a Denial of Service (DoS).

A use-after-free in the tracing histogram trigger path can occur when two hist triggers on different events use the same name. The second trigger may be freed in the named_data path while its hist_data entry remains linked in tr hist_vars, leaving a dangling pointer that is later dereferenced by find_var_file when another trigger references a variable. This is a real kernel heap UAF and the demonstrated outcome is a kernel panic. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate tracefs write access or tracing control to non root local users or service accounts, although the typical default configuration requires administrative tracing privileges. The issue is not network reachable and requires local access to the tracing control plane. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.