VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/99xxx/CVE-2026-99234.json
T

269 lines
14 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-99234",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2026-09-25T10:25:14.402Z",
"datePublished": "2026-11-02T16:06:41.083Z",
"dateUpdated": "2026-11-03T19:13:02.797Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-11-03T19:13:02.797Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n events/sched/sched_waking/trigger\n # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n >> events/sched/sched_switch/trigger\n # cat events/sched/sched_waking/trigger\n hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree."
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"versions": [
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "f21351d1c4cdcc6a68f03636a407c2af1a5e1e10",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "dba0f492703956801149cc70b39d2650a37995c3",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "a3d7ffd2409700748a495b645948fef48199206e",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "aae0ccd7326eef78dcdefffef3d1253e6f0615ca",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "8482ec5b65f606d5bbcec518e0afc69ad65ca414",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "431959fc76456cbba539279fe8967aa9391e6f23",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "5afb9317e2eeb1c7021a82995ce244fda5a4bd4f",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "d0090baf02dd08f6e909f36f0ad54a4e80f5e79b",
"status": "affected",
"versionType": "git"
},
{
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "91c14d6c13096091c56304120aaa26e479130b8b",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"versions": [
{
"version": "4.17",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.17",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.161",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.115",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.18.60",
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.2.14",
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.3.1",
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.4-rc1",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "5.10.273"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "5.15.224"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.1.191"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.6.161"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.12.115"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.18.60"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "7.2.14"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "7.3.1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "7.4-rc1"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10"
},
{
"url": "https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3"
},
{
"url": "https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e"
},
{
"url": "https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca"
},
{
"url": "https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414"
},
{
"url": "https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23"
},
{
"url": "https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f"
},
{
"url": "https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b"
},
{
"url": "https://git.kernel.org/stable/c/91c14d6c13096091c56304120aaa26e479130b8b"
}
],
"title": "tracing: Unregister field variable histograms when the command fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
}
}
View Git Blame Copy Permalink