CVE-2026-97935

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Set the trace clock before registering the histogram trigger

hist_register_trigger() puts the trigger on the global named_triggers

list in cmd_ops->init(), and only then sets the trace clock:

if (data->cmd_ops->init) {

ret = data->cmd_ops->init(data);

if (ret < 0)

goto out;

}

if (hist_data->enable_timestamps) {

ret = tracing_set_clock(file->tr, hist_data->attrs->clock);

if (ret) {

hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));

goto out;

}

The clock string is not checked anywhere before that call, so a named

trigger using common_timestamp with an unknown clock fails after it has

already become findable. event_hist_trigger_parse() then frees it

without taking it off the list, and the next lookup by name reads the

freed object:

~# cd /sys/kernel/tracing/events/sched/sched_switch

~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger

bash: echo: writ

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References