269249 matches found
CVE-2026-89750
In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...
EUVD-2026-76661
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89749
CVE-2026-89749 affects the Linux kernel tracing subsystem. In event_test_stuff(), the result of kthread_run() is unconditionally passed to kthread_stop(). When kthread_run() fails — for example returning ERR_PTR(-ENOMEM) under memory pressure during the boot-time event self-test — kthread_stop() ...
CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89749 tracing: Fix crash passing ERR_PTR to kthread_stop()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89749 tracing: Fix crash passing ERR_PTR to kthread_stop()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89748
CVE-2026-89748 is a logic error in the Linux kernel's tracing subsystem, specifically in simple_ring_buffer_swap_reader_page(). The function's retry counter is post-decremented only after a failed link replacement, so on the final attempt a successful replacement leaves retry at zero while a fail...
EUVD-2026-76660
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89749
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89748
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89747
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
EUVD-2026-76659
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
CVE-2026-89747
CVE-2026-89747 is a use-after-free vulnerability in the Linux kernel tracing subsystem , specifically in the trace_pipe read path. Writing to buffer_subbuf_size_kb triggers ring_buffer_subbuf_order_set(), which frees all sub-buffers (including the reader page) while active trace_pipe readers stil...
CVE-2026-89747 tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
CVE-2026-89747 tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
CVE-2026-89746 tracing: Fix use-after-free with same-name named triggers
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...
EUVD-2026-76658
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...
CVE-2026-89746
CVE-2026-89746 is a use-after-free in the Linux kernel's tracing subsystem, triggered when two hist triggers on different events share the same name=. The second trigger's hist_data is freed by hist_register_trigger() but its entry in tr->hist_vars is not removed, leaving a dangling pointer. A...
CVE-2026-89746
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...