Use-After-Free Vulnerability in Linux Kernel Affecting Tracing Mechanism

CVE-2026-89746

What is CVE-2026-89746?

A vulnerability exists in the Linux kernel related to the tracing mechanism where incorrect memory handling can lead to use-after-free conditions. When multiple histogram triggers are registered with identical names, the second trigger mistakenly reuses the data structure of the first. This oversight results in a dangling pointer, and a subsequent attempt to reference this freed data may trigger a kernel panic, destabilizing the entire system. The issue can be reproduced by specific trigger commands in the tracefs interface, highlighting a critical flaw in memory management that could have severe consequences for systems relying on the kernel's tracing capabilities. A fix has been implemented to properly handle data references prior to freeing memory, thereby mitigating the risk of system crashes.

References