{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-99234",
  "modified": "2026-11-03T05:30:01Z",
  "upstream": [
    "CVE-2026-99234"
  ],
  "published": "2026-11-02T15:14:24Z",
  "summary": "tracing: Unregister field variable histograms when the command fails",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Unregister field variable histograms when the command fails\n\nAn action that names a field on another event needs that field as a\nvariable, so create_field_var_hist() registers a second hist trigger on\nthat event to provide it, and records it in\ntarget_hist_data->field_var_hists[].\n\nIf a later part of the same command fails, create_actions() returns an\nerror and event_hist_trigger_parse() jumps to out_free. The write fails\nwith -EINVAL and sched_switch gets no trigger, but:\n\n  # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \\\n      events/sched/sched_waking/trigger\n  # echo 'my_synth u64 lat; int a; int b' >> synthetic_events\n  # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\\n      onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\\n      >> events/sched/sched_switch/trigger\n  # cat events/sched/sched_waking/trigger\n  hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]\n  hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]\n\nThe second histogram is the one created for 'prio'. It is still active and\nstill counting.\n\nout_free reaches destroy_field_var_hists(), which frees the\nfield_var_hists[] entries, but never unregister_field_var_hists(), which is\nwhat removes the triggers and runs only from event_hist_trigger_free(). The\nentry is freed and the trigger is left with nothing tracking it.\n\nUnregister the field variable histograms in out_free as well, and record\neach one as soon as its trigger is registered rather than after the lookup\nthat follows it, so no exit can leave a registered trigger untracked. The\nentry then belongs to field_var_hists[] and is released by\ndestroy_field_var_hists(), so freeing it on that exit would be a double\nfree.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.191",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-99234"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f21351d1c4cdcc6a68f03636a407c2af1a5e1e10"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/dba0f492703956801149cc70b39d2650a37995c3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a3d7ffd2409700748a495b645948fef48199206e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/aae0ccd7326eef78dcdefffef3d1253e6f0615ca"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8482ec5b65f606d5bbcec518e0afc69ad65ca414"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/431959fc76456cbba539279fe8967aa9391e6f23"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5afb9317e2eeb1c7021a82995ce244fda5a4bd4f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d0090baf02dd08f6e909f36f0ad54a4e80f5e79b"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-11-02T15:14:24Z"
  }
}