UBUNTU-CVE-2026-97919: Use After Free

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit() puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with: data->ref++; savenamedtrigger(data->nameddata->name, data); ret = eventhisttriggerinit(data->nameddata); if (ret < 0) { kfree(data->cmdops); data->cmdops = &triggerhistcmd; } return ret; eventhisttriggerinit() fails when allochistpad() cannot allocate, and nothing takes the trigger back off the list on the way out. eventhisttriggerparse() frees it, and the next lookup by name reads the freed object: BUG: KASAN: slab-use-after-free in findnamedtrigger+0xac/0xc0 Read of size 8 at addr ffff888009346860 by task init/1 findnamedtrigger+0xac/0xc0 histregistertrigger+0xc1/0xa00 eventhisttriggerparse+0x3146/0x6af0 eventtriggerwrite+0xce/0x160 Freed by task 67: kfree+0x154/0x420 triggerkthreadfn+0xfd/0x160 Do the reference first and publish once it has succeeded, so that nothing which can fail runs after the trigger becomes findable.