CVE-2026-97919

A flaw was found in the Linux kernel's tracing subsystem. When creating a named histogram trigger, the kernel registers the trigger before completing its setup. If initialization fails, the object is freed without being removed from the global tracking list. A local attacker can exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially memory corruption by triggering a use-after-free condition, where the kernel accesses previously released memory.

A moderate use-after-free vulnerability was found in the Linux kernel tracing subsystem, affecting the kernel component in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. When a named histogram trigger is created, event_hist_trigger_named_init() places the trigger on the global named_triggers list before taking a reference on the trigger that shares its histogram. If initialization subsequently fails, for example when a memory allocation in alloc_hist_pad() fails, the trigger object is freed without being removed from the list, and the next lookup by name dereferences the freed memory. A local attacker able to write to tracefs event trigger files, which requires appropriate privileges, could exploit this use-after-free to crash the kernel and cause a denial of service; memory corruption may also be possible. Red Hat scored this flaw MODERATE with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 6, 7, 8, and 9, Red Hat Enterprise Linux 10.0.z, and Red Hat OpenShift 4 are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.