CVE-2026-97921

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Free histogram the field rejected for a bad modifier

Writing a hist trigger whose value or variable carries a modifier that is

not allowed there leaks the fields that were built for it.

__create_val_field() takes the field from parse_expr() and stores it in

hist_data->fields[] only after the modifier checks have run:

hist_field = parse_expr(hist_data, file, field_str, flags, var_name,

&n_subexprs);

...

if (hist_field->flags & HIST_FIELD_FL_VAR) {

if (hist_field->flags & (...))

goto err;

} else {

if (hist_field->flags & (...))

goto err;

}

hist_data->fields[val_idx] = hist_field;

Both checks jump past that store, and the err label returns without

freeing anything. The error unwinds to create_hist_data(), which calls

destroy_hist_data() -> destroy_hist_fields(), and that reaches a field

only by walking fields[]. A field that never got there is unreachable.

commit e0213434fe3e ("tracing:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References