CVE-2026-97935

A flaw was found in the Linux kernel's tracing subsystem. A local user with access to configure event triggers can trigger a use-after-free condition, leading to a system crash, Denial of Service (DoS), or potential privilege escalation. This issue occurs when registering a named histogram trigger with an invalid clock setting, which publishes the trigger to a global list before validating the clock. When the operation subsequently fails, the trigger object is freed without being removed from the list, allowing a subsequent lookup to access the freed memory.

A use-after-free in the tracing histogram named trigger path occurs when a trigger using common_timestamp with an invalid clock is published before tracing_set_clock rejects the clock. Error cleanup frees the trigger without removing it from global named_triggers, and a later trigger lookup by name dereferences freed kernel memory. A local actor able to write tracefs event trigger files can issue the failing configuration and then trigger a lookup using the same name. For the CVSS the PR:L paranoid value assumes tracefs trigger access has been delegated to a non administrative local service or container account. On conventional hosts this access is normally restricted to root or highly privileged tracing administrators. The immediate impact is a kernel crash. The issue is not directly network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.