CVE-2026-99234

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Unregister field variable histograms when the command fails<br /> <br /> An action that names a field on another event needs that field as a<br /> variable, so create_field_var_hist() registers a second hist trigger on<br /> that event to provide it, and records it in<br /> target_hist_data-&gt;field_var_hists[].<br /> <br /> If a later part of the same command fails, create_actions() returns an<br /> error and event_hist_trigger_parse() jumps to out_free. The write fails<br /> with -EINVAL and sched_switch gets no trigger, but:<br /> <br /> # echo &amp;#39;hist:keys=pid:ts0=common_timestamp.usecs&amp;#39; &gt;&gt; \<br /> events/sched/sched_waking/trigger<br /> # echo &amp;#39;my_synth u64 lat; int a; int b&amp;#39; &gt;&gt; synthetic_events<br /> # echo &amp;#39;hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\<br /> onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)&amp;#39;\<br /> &gt;&gt; events/sched/sched_switch/trigger<br /> # cat events/sched/sched_waking/trigger<br /> hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]<br /> hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]<br /> <br /> The second histogram is the one created for &amp;#39;prio&amp;#39;. It is still active and<br /> still counting.<br /> <br /> out_free reaches destroy_field_var_hists(), which frees the<br /> field_var_hists[] entries, but never unregister_field_var_hists(), which is<br /> what removes the triggers and runs only from event_hist_trigger_free(). The<br /> entry is freed and the trigger is left with nothing tracking it.<br /> <br /> Unregister the field variable histograms in out_free as well, and record<br /> each one as soon as its trigger is registered rather than after the lookup<br /> that follows it, so no exit can leave a registered trigger untracked. The<br /> entry then belongs to field_var_hists[] and is released by<br /> destroy_field_var_hists(), so freeing it on that exit would be a double<br /> free.