CVE-2026-97918

A use-after-free flaw was found in the Linux kernel's tracing subsystem histogram trigger implementation (kernel/trace/trace_events_hist.c), which Red Hat rates as Moderate impact. When enabling a histogram event trigger fails, the error path removes the trigger from the per-file trigger list before the normal unregistration processing runs, so the cleanup code cannot find it and skips removing its entry from the global named_triggers list; the trigger is then freed while still referenced there. Subsequent trigger operations, such as find_named_trigger(), can dereference that freed memory (KASAN reports a slab-use-after-free read), most likely crashing the kernel and causing a denial of service. Exploiting this flaw requires local access with the privileges needed to configure event tracing through tracefs, typically root or CAP_SYS_ADMIN. Because the confirmed impact is a read of freed memory by an already-privileged local user and no arbitrary memory write has been demonstrated, Red Hat assesses this as a denial-of-service issue (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower in practical severity than the upstream description's mention of potential privilege escalation. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams, the fix is deferred: since only users who already hold administrative privileges on the system can trigger the flaw and the primary consequence is a kernel crash, the fix will be delivered in a future scheduled update rather than an immediate erratum. The residual risk is therefore limited to denial of service by an already-privileged local user.