CVE-2026-97923: tracing: Free histogram the var ref when its initialization fails

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

tracing: Free histogram the var ref when its initialization fails

createvarref() allocates a VARREF histfield and then calls initvarref() to fill it in. When that fails the field is leaked.

commit 656fe2ba85e8 ("tracing: Use hist trigger's varref array to destroy varrefs") made destroyhistfield() return early for HISTFIELDFLVARREF, since var refs are freed by walking the trigger's varrefs[] array instead. createvarref() adds the field to that array only after initvarref() has succeeded, so on this path the field is in neither place and nothing frees it. The call was correct when it was written, before var refs were taken out of destroyhistfield().

initvarref() cannot free it either. The caller owns the field, so initvarref() undoes only its own string allocations and leaves the field alone. Freeing it there would leave createvarref() passing freed memory to destroyhistfield(), which reads its flags.

Call destroyhistfield(), which frees the field without consulting the flag.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

Under what condition does the memory leak occur?

The leak occurs when create_var_ref() allocates a VAR_REF histogram field but init_var_ref() fails. At that point, the field has not yet been added to the trigger's var_refs[] array, while normal histogram-field destruction skips VAR_REF fields.

2

Is this issue triggered during normal successful histogram variable-reference creation?

No. The described leak is limited to the initialization-failure path in create_var_ref(); successful initialization adds the variable reference to the trigger's var_refs[] array for later cleanup.

3

What is the implemented fix?

The failure path calls __destroy_hist_field(), which frees the allocated field without checking its VAR_REF flag. This avoids the early-return behavior in destroy_hist_field() that previously left the allocation unreleased.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203