CVE-2026-97920

A flaw was found in the Linux kernel. A local user could trigger this vulnerability by reading an event tracing histogram file when a memory allocation failure occurs. Because an error code overwrites the entry counter during cleanup, the system treats the error as an extremely large positive number and attempts to free memory past the allocated boundary. This out-of-bounds memory access can cause memory corruption and crash the system, resulting in a Denial of Service (DoS).

A moderate-impact out-of-bounds memory access flaw was found in the Linux kernel's ftrace histogram implementation. When a local user with privileges to configure and read event tracing histograms reads the hist file of a trigger that uses a .percent value and the histogram stats memory allocation fails, the -ENOMEM error overwrites the entry count. The cleanup function tracing_map_destroy_sort_entries() then interprets that negative value as a very large unsigned loop bound, walks past the allocated sort-entry array, and dereferences and frees out-of-bounds pointers, which can cause memory corruption and a fatal kernel fault. The demonstrated result is a kernel crash, so the impact is a denial of service (Red Hat CVSS:3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The vulnerable code path depends on histogram .percent/.graph value modifiers, which upstream mainline has rejected since v6.3 and which only become reachable again with the companion change that restores those modifiers. Red Hat Enterprise Linux 6, 7, 8, and 9, and the RHEL CoreOS images used by OpenShift Container Platform, are not affected because the vulnerable code is not present. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected, and the fix has been deferred to a future update because practical exploitation requires local privileged access to configure a tracing histogram trigger with a .percent or .graph value together with an induced memory allocation failure; the residual risk of the deferral is therefore limited to a local denial of service, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.