Answer in brief
CVE-2026-89746 records a Unknown severity vulnerability in tracing: Fix use-after-free with same-name named triggers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=435d2964af815aae456db554c62963b4515f19d0 <477d762be4b0ffaf01429ccd88859e93b0ec28cc || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <b1a49c22de01faf176d44e5caa765e237353a579 || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <83d1ae0406d8eade219a81b401e201702dd9dc55 || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <a7318172aa332a161fb9618286e64454c827f8fd || 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 || 43b254d46c740bf9dbe65709afa021dd726dfa99 || f1ae50cfb818ce1ac7a674406dfadb7653e2552d || >=6.12.18 <6.12.109 || >=6.1.130 <6.2 || >=6.6.81 <6.7 || >=6.13.6 <6.14 | 477d762be4b0ffaf01429ccd88859e93b0ec28cc, b1a49c22de01faf176d44e5caa765e237353a579, 83d1ae0406d8eade219a81b401e201702dd9dc55, a7318172aa332a161fb9618286e64454c827f8fd, 6.12.109, 6.2, 6.7, 6.14 |
| Linux/Linuxgeneric | 6.14 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.
Quoted source text, attributed separately from HOL analysis.