Answer in brief
CVE-2026-89746 records a High severity (CVSS 7.8) vulnerability in tracing: Fix use-after-free with same-name named triggers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=435d2964af815aae456db554c62963b4515f19d0 <477d762be4b0ffaf01429ccd88859e93b0ec28cc || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <b1a49c22de01faf176d44e5caa765e237353a579 || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <83d1ae0406d8eade219a81b401e201702dd9dc55 || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <a7318172aa332a161fb9618286e64454c827f8fd || 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 || 43b254d46c740bf9dbe65709afa021dd726dfa99 || f1ae50cfb818ce1ac7a674406dfadb7653e2552d || >=6.12.18 <6.12.109 || >=6.1.130 <6.2 || >=6.6.81 <6.7 || >=6.13.6 <6.14 | 477d762be4b0ffaf01429ccd88859e93b0ec28cc, b1a49c22de01faf176d44e5caa765e237353a579, 83d1ae0406d8eade219a81b401e201702dd9dc55, a7318172aa332a161fb9618286e64454c827f8fd, 6.12.109, 6.2, 6.7, 6.14 |
| Linux/Linuxgeneric | 6.14 | Not reported |
| Linux/Linuxgeneric | >=5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 <441aa6742dff70297b5f64533a07a6189a026e91 || >=43b254d46c740bf9dbe65709afa021dd726dfa99 <3a8534664426c071c2dfb5b4ffa36b18a2abfd79 || >=435d2964af815aae456db554c62963b4515f19d0 <477d762be4b0ffaf01429ccd88859e93b0ec28cc || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <b1a49c22de01faf176d44e5caa765e237353a579 || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <83d1ae0406d8eade219a81b401e201702dd9dc55 || >=6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e <a7318172aa332a161fb9618286e64454c827f8fd || f1ae50cfb818ce1ac7a674406dfadb7653e2552d || >=6.1.130 <6.1.188 || >=6.6.81 <6.6.157 || >=6.12.18 <6.12.109 || >=6.13.6 <6.14 | 441aa6742dff70297b5f64533a07a6189a026e91, 3a8534664426c071c2dfb5b4ffa36b18a2abfd79, 477d762be4b0ffaf01429ccd88859e93b0ec28cc, b1a49c22de01faf176d44e5caa765e237353a579, 83d1ae0406d8eade219a81b401e201702dd9dc55, a7318172aa332a161fb9618286e64454c827f8fd, 6.1.188, 6.6.157, 6.12.109, 6.14 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.
Quoted source text, attributed separately from HOL analysis.