CVE-2026-97919 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users who rely on the tracing subsystem should assess exposure and prioritize verification of affected kernel versions and configurations.

Why it matters

A use-after-free vulnerability in the Linux kernel's tracing subsystem requires attention from developers, maintainers, and users to assess exposure and prioritize verification of affected kernel versions and configurations.

• Potential use-after-free error leading to system crashes or instability
• Exposure of sensitive data or unauthorized access
• Elevation of privileges or denial of service
• Verification of affected kernel versions and configurations required

Technical summary

The event_hist_trigger_named_init function in the Linux kernel's tracing subsystem incorrectly publishes a trigger on the global named_triggers list before taking a reference on the trigger. This can lead to a use-after-free error when event_hist_trigger_parse fails and frees the trigger. The vulnerability exists in the Linux kernel's tracing subsystem, specifically in the handling of named histogram triggers. Linux kernel developers and maintainers should assess exposure and prioritize verification of affected kernel versions and configurations.

Defensive priority

Linux kernel developers and maintainers should assess exposure and prioritize verification of affected kernel versions and configurations.

Recommended defensive actions

• Review Linux kernel source code and verify affected versions
• Assess exposure and apply patches or mitigations as needed
• Monitor system logs for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and associated source references provide details on the vulnerability, including a KASAN report indicating a slab-use-after-free error. Linux kernel developers and maintainers should verify affected kernel versions and configurations, assess exposure, and apply patches or mitigations as needed. The vulnerability exists in the Linux kernel's tracing subsystem, specifically in the handling of named histogram triggers. The event_hist_trigger_named_init function incorrectly publishes the trigger on the global named_triggers

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.