Executive brief
The Linux kernel's tracing subsystem contains a memory-safety bug in how it manages histogram triggers with identical names. When multiple histogram triggers share the same name across different events, the kernel incorrectly frees memory while leaving dangling references. An attacker with local access can trigger a kernel panic by writing specially crafted trigger commands to the tracing interface, causing a denial of service and potentially allowing code execution.
Technical details
The vulnerability is a use-after-free flaw in the kernel's histogram trigger registration logic (tracing subsystem). When two named histogram triggers are registered with identical names on different events, the second trigger reuses the first as named_data. The bug occurs because save_hist_vars() adds both entries to tr->hist_vars before named reuse is detected, but hist_register_trigger() then frees the second histogram's hist_data without removing its tr->hist_vars list entry, leaving a dangling pointer. This causes a KASAN-detected slab-use-after-free when a subsequent histogram trigger references a variable and find_var_file() dereferences the freed memory. The attack requires local access to /sys/kernel/tracing and no authentication, triggering kernel panic via carefully sequenced trigger writes.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed