# CVE-2026-89746

## Summary

- **CVE ID:** CVE-2026-89746
- **Severity:** HIGH
- **CVSS Score:** 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named_data.  Both are added to
tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(),
because save_hist_vars() is called before event_trigger_register() while
the named reuse is only detected later, in hist_register_trigger().

In the named-data branch hist_register_trigger() then frees the second
histogram's hist_data via destroy_hist_data(), but never removes its
tr->hist_vars list entry, leaving a dangling pointer and leaking the
trace_array reference it holds.

A later hist trigger that references a variable makes find_var_file()
walk tr->hist_vars and dereference the freed hist_data.  The bug is
reproducible from userspace by writing three hist triggers to tracefs:

  cd /sys/kernel/tracing
  echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger
  echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger
  echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger

The third write panics the kernel:

  BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290
  Read of size 8 at addr ffff888001f8a0e0 by task sh/1
  CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G      D          N
  Call Trace:
    find_var_file.part.0
    find_event_var
    parse_atom
    parse_expr
    __create_val_field
    event_hist_trigger_parse
    trigger_process_regex
    event_trigger_write
    vfs_write
    ksys_write
    do_syscall_64
    entry_SYSCALL_64_after_hwframe
  Allocated by task 1:
    event_hist_trigger_parse
  Freed by task 1:
    hist_register_trigger+0x618/0xa30
    event_hist_trigger_parse
  The buggy address belongs to freed 2048-byte region
  Oops: general protection fault ... RIP: find_var_file.part.0
  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Fix by removing the hist_data from tr->hist_vars and releasing the
trace_array reference in the named-data branch of hist_register_trigger()
before freeing the hist_data.

## Affected Products

- Linux — Linux (435d2964af815aae456db554c62963b4515f19d0)
- Linux — Linux (6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e)
- Linux — Linux (5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77)
- Linux — Linux (43b254d46c740bf9dbe65709afa021dd726dfa99)
- Linux — Linux (f1ae50cfb818ce1ac7a674406dfadb7653e2552d)
- Linux — Linux (6.12.18)
- Linux — Linux (6.1.130)
- Linux — Linux (6.6.81)
- Linux — Linux (6.13.6)
- Linux — Linux (6.14)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (6.1.188)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc)
- [CNA](https://git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579)
- [CNA](https://git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55)
- [CNA](https://git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd)
- [CNA](https://git.kernel.org/stable/c/441aa6742dff70297b5f64533a07a6189a026e91)
- [CNA](https://git.kernel.org/stable/c/3a8534664426c071c2dfb5b4ffa36b18a2abfd79)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.16%
- **EPSS Percentile:** 5.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._