VulnerabilityPublished 25 Sep 2026Updated 30 Oct 2026

CVE-2026-97935: Linux kernel · tracing: Set the trace clock before registering the histogram trigger

Source GCVE Database

Compare

Authoritative record:CVE-2026-97935· Medium

Not known to be exploited · fixed in cfad128171f8e2237a3c723d6478ef2cfb3b9127 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 17:19 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in cfad128171f8e2237a3c723d6478ef2cfb3b9127, cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad, c7b77c22adcf314ec8aa4807f01914dcbc62ed54 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-p8vq-x7mj-pgvj

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ a4072fe85ba3671720cab0788291af953db27318, < cfad128171f8e2237a3c723d6478ef2cfb3b9127	Fixed in cfad128171f8e2237a3c723d6478ef2cfb3b9127
LinuxLinux	Affected ≥ a4072fe85ba3671720cab0788291af953db27318, < cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad	Fixed in cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad
LinuxLinux	Affected ≥ a4072fe85ba3671720cab0788291af953db27318, < c7b77c22adcf314ec8aa4807f01914dcbc62ed54	Fixed in c7b77c22adcf314ec8aa4807f01914dcbc62ed54
LinuxLinux	Affected ≥ a4072fe85ba3671720cab0788291af953db27318, < 3568dabef3fb56517777ab981584f72ab1e90186	Fixed in 3568dabef3fb56517777ab981584f72ab1e90186
LinuxLinux	Affected ≥ a4072fe85ba3671720cab0788291af953db27318, < 578d39ab420b18b76a12fc8d0573ec041a84da28	Fixed in 578d39ab420b18b76a12fc8d0573ec041a84da28
LinuxLinux	Affected ≥ a4072fe85ba3671720cab0788291af953db27318, < 85e6df6e9cd489de8e238596a68b89eee0c03b88	Fixed in 85e6df6e9cd489de8e238596a68b89eee0c03b88

AI-suggested

A fix has been implemented in the Linux kernel to set the trace clock before registering the histogram trigger, preventing the use-after-free condition. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.

Description

A use-after-free vulnerability in the Linux kernel tracing subsystem was fixed by setting the trace clock before registering the histogram trigger. The flaw allowed a named trigger to become findable before its clock was validated, leading to a use-after-free when an invalid clock was specified. This could cause a kernel crash due to accessing freed memory.

Impact

This vulnerability can lead to a kernel use-after-free condition, causing kernel crashes (BUG: KASAN slab-use-after-free) and potential system instability. There is no indication of remote exploitation or privilege escalation from the provided data.

Summary

CVE-2026-97935 addresses a flaw in the Linux kernel tracing code where hist_register_trigger() adds a trigger to the global named_triggers list before setting the trace clock. If the clock string is invalid, the trigger fails after registration and is freed without removal from the list, causing subsequent lookups to access freed memory, resulting in a use-after-free bug. The fix involves setting the trace clock before registering the trigger to ensure no failure occurs after the trigger is published. Additionally, reference counting for tracing_set_filter_buffering() is adjusted to handle failure paths correctly.

References

Community reviews

Loading reviews…