CVE-2026-97918

A flaw was found in the Linux kernel's tracing subsystem. When enabling a histogram event trigger fails, improper registration cleanup can leave an already freed trigger referenced on an internal tracking list. A local attacker with permission to configure event tracing could exploit this flaw to cause a use-after-free condition, leading to a system crash and Denial of Service (DoS) or potential privilege escalation.

A use-after-free flaw was found in the Linux kernel's tracing subsystem histogram trigger implementation (kernel/trace/trace_events_hist.c), which Red Hat rates as Moderate impact. When enabling a histogram event trigger fails, the error path removes the trigger from the per-file trigger list before the normal unregistration processing runs, so the cleanup code cannot find it and skips removing its entry from the global named_triggers list; the trigger is then freed while still referenced there. Subsequent trigger operations, such as find_named_trigger(), can dereference that freed memory (KASAN reports a slab-use-after-free read), most likely crashing the kernel and causing a denial of service. Exploiting this flaw requires local access with the privileges needed to configure event tracing through tracefs, typically root or CAP_SYS_ADMIN. Because the confirmed impact is a read of freed memory by an already-privileged local user and no arbitrary memory write has been demonstrated, Red Hat assesses this as a denial-of-service issue (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower in practical severity than the upstream description's mention of potential privilege escalation. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams, the fix is deferred: since only users who already hold administrative privileges on the system can trigger the flaw and the primary consequence is a kernel crash, the fix will be delivered in a future scheduled update rather than an immediate erratum. The residual risk is therefore limited to denial of service by an already-privileged local user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.