In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An…
CVE-2026-99234
In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist() registers a second hist trigger on that event to provide it, and records it in targethistdata->fieldvarhists[]. If a later part of the same command fails, createactions() returns an error and eventhisttriggerparse() jumps to outfree. The write fails with -EINVAL and schedswitch gets no trigger, but: echo 'hist:keys=pid:ts0=commontimestamp.usecs' >> \ events/sched/schedwaking/trigger echo 'mysynth u64 lat; int a; int b' >> syntheticevents echo 'hist:keys=nextpid:wakeuplat=commontimestamp.usecs-$ts0:\ onmatch(sched.schedwaking).mysynth($wakeuplat,prio,nosuchfld)'\ events/sched/schedswitch/trigger cat events/sched/schedwaking/trigger hist:keys=pid:vals=hitcount:ts0=commontimestamp.usecs:sort=hitcount:size=2048:clock=global [active] hist:keys=pid:vals=hitcount:syntheticprio=prio:sort=hitcount:size=2048 [active] The second histogram is the one created for 'prio'. It is still active and still counting. outfree reaches destroyfieldvarhists(), which…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 2 November 2026
- Last updated
- 2 November 2026
- Assigner
- Linux
At the source
References
- https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10
- https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3
- https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e
- https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca
- https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414
- https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23
- https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f
- https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99234