CVE-2026-97921

The Linux kernel contains a memory leak in the tracing subsystem. When creating a histogram trigger with a value or variable carrying an invalid modifier, the kernel identifies the error but fails to free the allocated field because it is skipped during the store operation. This results in unrefe...

CVE-2026-97922

The Linux kernel contains a memory leak vulnerability in the tracing subsystem. Specifically, using the same variable three or more times in a single hist trigger causes the variable reference and its associated strings to leak when the trigger is removed. The root cause is that while repeated re...

CVE-2026-97922 tracing: Free histogram var refs regardless of how often they are referenced

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

CVE-2026-97921 tracing: Free histogram the field rejected for a bad modifier

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

CVE-2026-97921 tracing: Free histogram the field rejected for a bad modifier

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

EUVD-2026-86775

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

EUVD-2026-86776

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

CVE-2026-97920 tracing: Keep the entry count when the histogram stats allocation fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

CVE-2026-97920 tracing: Keep the entry count when the histogram stats allocation fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

EUVD-2026-86774

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

CVE-2026-97920

The Linux kernel contains a vulnerability where the print_entries() function incorrectly handles memory allocation failures. When a histogram stats allocation fails, the variable n_entries is overwritten with -ENOMEM. Because tracing_map_destroy_sort_entries() treats this value as an unsigned int...

CVE-2026-97919 tracing: Take the reference before publishing the named histogram trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

CVE-2026-97918

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue occurs because a trigger registered during a failed hist_trigger_enable() operation remains on the global named_triggers list but is not on the file->triggers list. This causes hist_unregister_trigger()...

CVE-2026-97918 tracing: Undo the registration when enabling the histogram trigger fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

EUVD-2026-86772

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

CVE-2026-97918 tracing: Undo the registration when enabling the histogram trigger fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

CVE-2026-97919

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue occurs in event_hist_trigger_named_init() because the function publishes a trigger to the global named_triggers list before ensuring the subsequent initialization (event_hist_trigger_init()) succeeds. If a...

CVE-2026-97919 tracing: Take the reference before publishing the named histogram trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

EUVD-2026-86773

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

EUVD-2026-86771

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...