CVE-2026-89746: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89746 Overview

CVE-2026-89746 is a use-after-free vulnerability in the Linux kernel tracing subsystem. The flaw resides in the histogram trigger handling code path used by the tracefs interface. When two hist triggers on different events are registered with the same name=, the second reuses the first as named_data. Both entries are added to tr->hist_vars by save_hist_vars() before the named-reuse condition is detected in hist_register_trigger(). The kernel then frees the second histogram's hist_data without removing its tr->hist_vars list entry, leaving a dangling pointer and leaking the associated trace_array reference. A subsequent hist trigger referencing a variable causes find_var_file() to dereference the freed memory.

Critical Impact
A local user with write access to tracefs can trigger a kernel use-after-free that leads to kernel panic or potential local privilege escalation on unpatched systems.

Affected Products

Linux kernel (upstream) prior to the fix commits listed in the kernel Git advisory
Linux stable branches receiving backports across the six referenced commits
Distribution kernels that ship the histogram trigger tracing feature via CONFIG_HIST_TRIGGERS

Discovery Timeline

2026-09-11 - CVE-2026-89746 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89746

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the kernel tracing histogram trigger logic. The root of the bug is an ordering issue between save_hist_vars() and event_trigger_register(). During event_hist_trigger_parse(), the kernel appends a newly allocated hist_data structure to tr->hist_vars before checking whether the trigger name is already in use. When hist_register_trigger() later detects that the trigger reuses an existing named histogram, it frees the redundant hist_data via destroy_hist_data() but never removes the corresponding entry from tr->hist_vars.

The result is a dangling pointer inside the trace array's list, plus a leaked trace_array reference count. Any subsequent hist trigger that references a variable triggers find_var_file() to walk tr->hist_vars and dereference the freed 2048-byte region, as observed by KASAN.

Root Cause

The ordering of state changes in event_hist_trigger_parse() violates cleanup invariants. Registration-side detection of named reuse in hist_register_trigger() runs after the histogram is registered as a variable owner. The named-data branch tears down the object without unlinking it, so the tracked list still holds a reference to the freed allocation. The linked trace_array reference held by the freed structure is also never released.

Attack Vector

Exploitation requires local access and the ability to write to files under /sys/kernel/tracing. The reproducer writes three hist trigger definitions to events/sched/sched_switch/trigger, events/sched/sched_process_fork/trigger, and events/sched/sched_process_exit/trigger. The first two share the same name=mh, forcing the named-reuse path and freeing the second hist_data. The third trigger references variable $x, causing find_var_file() to walk the stale list entry and read freed memory, producing a general protection fault and kernel panic. Depending on heap state, freed slab reuse could enable manipulation of kernel memory rather than a crash.

No verified public exploit code beyond the reproducer described in the upstream commit message is available. See the Kernel Git Commit 3a85346 for the authoritative fix and technical description.

Detection Methods for CVE-2026-89746

Indicators of Compromise

KASAN report entries containing slab-use-after-free in find_var_file.part.0 in kernel logs.
Unexpected kernel general protection faults with RIP: find_var_file.part.0 in the crash trace.
Kernel panic messages referencing event_hist_trigger_parse in the call stack shortly after tracefs writes.

Detection Strategies

Audit writes to /sys/kernel/tracing/events/**/trigger files using kernel audit rules on the tracefs mount.
Monitor for unprivileged or unexpected processes issuing write() syscalls to trigger files, correlated with subsequent kernel oops events.
Track kernel crash dumps and dmesg output for find_var_file and hist_register_trigger symbols in the fault trace.

Monitoring Recommendations

Enable persistent kernel crash collection via kdump so use-after-free panics are captured for forensic review.
Forward dmesg and journald kernel logs to a centralized analytics platform to correlate tracefs activity with kernel faults.
Restrict and log access to /sys/kernel/tracing and /sys/kernel/debug/tracing to detect anomalous local activity.

How to Mitigate CVE-2026-89746

Immediate Actions Required

Apply the upstream kernel patches referenced in the advisory or upgrade to a distribution kernel that includes the fix.
Restrict tracefs write access to root-only until the patch is deployed by ensuring the mount is not exposed to unprivileged users or containers.
Audit container and sandbox configurations to confirm they do not bind-mount /sys/kernel/tracing with write permissions.

Patch Information

The fix removes the freed hist_data from tr->hist_vars and releases the associated trace_array reference in the named-data branch of hist_register_trigger() before calling destroy_hist_data(). Patches are available in the following commits: 3a85346, 441aa67, 477d762, 83d1ae0, a731817, and b1a49c2.

Workarounds

Unmount or remount tracefs read-only where operational requirements permit: mount -o remount,ro /sys/kernel/tracing.
Rebuild kernels without CONFIG_HIST_TRIGGERS if histogram triggers are not required in the deployment.
Ensure only privileged administrators are in groups permitted to write to trigger files, and remove world-writable overrides in custom udev or systemd unit configurations.

bash

# Remount tracefs read-only as an interim mitigation
mount -o remount,ro /sys/kernel/tracing

# Verify current mount options
findmnt /sys/kernel/tracing