CVE-2026-97920

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Keep the entry count when the histogram stats allocation fails

print_entries() uses n_entries both as the number of sort entries and as

its own return value, so the -ENOMEM it stores when the stats allocation

fails overwrites the count that the cleanup still needs:

n_entries = tracing_map_sort_entries(map, ...);

if (n_entries < 0)

return n_entries;

...

if (!stats) {

n_entries = -ENOMEM;

goto out;

}

...

out:

tracing_map_destroy_sort_entries(sort_entries, n_entries);

tracing_map_destroy_sort_entries() takes an unsigned int and loops up to

it, so -ENOMEM arrives as 4294967284. It walks an array of at most

map->max_elts pointers and calls destroy_sort_entry(), which dereferences

and frees, on whatever lies past the end.

Reading the hist file of a trigger with a .percent value, with that

allocation forced to fail:

BUG: KASAN: vmalloc-out-of-bounds in tracing_map_destroy_sort_entries+0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References