{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97935 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97935 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97935 and fix it if it is affected.\n\nWhat it is: CVE-2026-97935 is an use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97935 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97935/ (Markdown: https://insights.sbomify.com/CVE-2026-97935/index.md)","id":"CVE-2026-97935","markdown":"https://insights.sbomify.com/CVE-2026-97935/index.md","name":"CVE-2026-97935","record":{"aliases":["AZL-104718","BELL-CVE-2026-97935","DEBIAN-CVE-2026-97935","GHSA-p8vq-x7mj-pgvj","UBUNTU-CVE-2026-97935"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel tracing","requires_auth":"high_privilege","summary":"A use-after-free in the Linux kernel tracing subsystem allows local attackers with high privileges to execute arbitrary code or escalate privileges via histogram triggers.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Set the trace clock before registering the histogram trigger\n\nhist_register_trigger() puts the trigger on the global named_triggers\nlist in cmd_ops-\u003einit(), and only then sets the trace clock:\n\n\tif (data-\u003ecmd_ops-\u003einit) {\n\t\tret = data-\u003ecmd_ops-\u003einit(data);\n\t\tif (ret \u003c 0)\n\t\t\tgoto out;\n\t}\n\n\tif (hist_data-\u003eenable_timestamps) {\n\t\tret = tracing_set_clock(file-\u003etr, hist_data-\u003eattrs-\u003eclock);\n\t\tif (ret) {\n\t\t\thist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));\n\t\t\tgoto out;\n\t\t}\n\nThe clock string is not checked anywhere before that call, so a named\ntrigger using common_timestamp with an unknown clock fails after it has\nalready become findable. event_hist_trigger_parse() then frees it\nwithout taking it off the list, and the next lookup by name reads the\nfreed object:\n\n ~# cd /sys/kernel/tracing/events/sched/sched_switch\n ~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' \u003e trigger\n bash: echo: write error: Invalid argument\n ~# echo 'hist:name=foo:keys=common_pid' \u003e trigger\n\n  BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n  Read of size 8 at addr ffff88800915d760 by task init/1\n   find_named_trigger+0xac/0xc0\n   hist_register_trigger+0xc1/0x900\n   event_hist_trigger_parse+0x3146/0x6af0\n   event_trigger_write+0xce/0x160\n  Freed by task 63:\n   kfree+0x154/0x420\n   trigger_kthread_fn+0xfd/0x160\n\nSet the clock before the trigger is registered, so that nothing which\ncan fail runs after it is published, the way commit 6f86bdeab633\n(\"tracing: Fix bad hist from corrupting named_triggers list\") moved the\nregistration below the rest of the setup.\n\ntracing_set_filter_buffering() is reference counted, so the init failure\npath has to drop the reference that the clock block now takes first.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"tracing: Set the trace clock before registering the histogram trigger","id":"CVE-2026-97935","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"tracing: Fix memory corruption from the histogram stacktrace modifier","id":"CVE-2026-97936"},"packages":[],"prev":{"headline":"tracing: Fix memory corruption from a \"STACKTRACE\" histogram key","id":"CVE-2026-97934"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel tracing subsystem allows local attackers with high privileges to execute arbitrary code or escalate privileges via histogram triggers.","url":"https://insights.sbomify.com/CVE-2026-97935/"}