CVE-2026-97932: tracing: Don't dereference trace_event_file in deferred trigger free
In the Linux kernel, the following vulnerability has been resolved:
tracing: Don't dereference traceeventfile in deferred trigger free
The enableevent trigger defers traceeventputref() to the trigger free kthread, but the traceeventfile can already be freed when the instance is removed.
Keep the traceeventcall directly in enabletriggerdata so the deferred free does not access the freed traceeventfile.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the use-after-free?
An enable_event trigger must defer trace_event_put_ref() to the trigger-free kernel thread, and the associated tracing instance must be removed before that deferred cleanup runs. In that sequence, the trace_event_file may already have been freed.
Which systems are exposed?
Systems using the Linux kernel tracing subsystem with enable_event triggers and tracing-instance removal are exposed to the affected cleanup path. The provided information does not identify specific kernel versions, distributions, or default configurations.
What is the mitigation if an update cannot be applied immediately?
Avoid the triggering lifecycle: do not remove a tracing instance while enable_event trigger cleanup may still be pending. The provided information does not specify another workaround or configuration change.