Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89746— tracing: Fix use-after-free with same-name named triggers

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于同名命名触发器注册时，hist_register_trigger()释放hist_data后未从tr->hist_vars列表中移除对应条目，留下悬空指针，后续触发器引用变量时find_var_file()会访问已释放的hist_data，形成释放后重用，可能导致内核崩溃。

CVSS 7.8 · High EPSS 0.16% · P5

Possible ATT&CK Techniques 2 AI

T1206.003 T1531 · Account Access Removal

Affected Version Matrix 19

VendorProduct Version RangeStatus
Linux Linux 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77< 441aa6742dff70297b5f64533a07a6189a026e91 affected
43b254d46c740bf9dbe65709afa021dd726dfa99< 3a8534664426c071c2dfb5b4ffa36b18a2abfd79 affected
435d2964af815aae456db554c62963b4515f19d0< 477d762be4b0ffaf01429ccd88859e93b0ec28cc affected
6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e< b1a49c22de01faf176d44e5caa765e237353a579 affected
6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e< 83d1ae0406d8eade219a81b401e201702dd9dc55 affected
6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e< a7318172aa332a161fb9618286e64454c827f8fd affected
f1ae50cfb818ce1ac7a674406dfadb7653e2552d affected
6.1.130< 6.1.188 affected
… +11 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89746

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tracing: Fix use-after-free with same-name named triggers
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于同名命名触发器注册时，hist_register_trigger()释放hist_data后未从tr->hist_vars列表中移除对应条目，留下悬空指针，后续触发器引用变量时find_var_file()会访问已释放的hist_data，形成释放后重用，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 ~ 441aa6742dff70297b5f64533a07a6189a026e91 -
Linux Linux 6.14 -

II. Public POCs for CVE-2026-89746

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89746

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89746 (6)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89536 9.8 CRITICAL SUNRPC: wait for in-flight client TLS handshake callback
CVE-2026-89533 9.8 CRITICAL svcrdma: Fix offset arithmetic in read_chunk_range
CVE-2026-81002 9.8 CRITICAL xdp: fix zero-copy frame layout
CVE-2026-89643 9.8 CRITICAL audit: avoid dropping live tree ref on fsnotify rule autoremove
CVE-2026-89526 9.8 CRITICAL svcrdma: Validate Read chunk positions before reconstruction
CVE-2026-89652 9.8 CRITICAL ceph: bound copied dentry name length in NFS export get_name
CVE-2026-89651 9.8 CRITICAL ceph: bound MDSCapAuth path and fs_name decode in handle_session()
CVE-2026-89653 9.8 CRITICAL ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
CVE-2026-89654 9.8 CRITICAL ceph: fix UAF in check_new_map() on session freed during unlock
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89712 9.8 CRITICAL NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89689 9.8 CRITICAL nfsd: don't free session slots that are still in use
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89746

No comments yet

Leave a comment