{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.115-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  tracing: Unregister field variable histograms when the command fails  An action that names a field on another event needs that field as a variable, so create_field_var_hist() registers a second hist trigger on that event to provide it, and records it in target_hist_data-\u003efield_var_hists[].  If a later part of the same command fails, create_actions() returns an error and event_hist_trigger_parse() jumps to out_free. The write fails with -EINVAL and sched_switch gets no trigger, but:    # echo 'hist:keys=pid:ts0=common_timestamp.usecs' \u003e\u003e \\       events/sched/sched_waking/trigger   # echo 'my_synth u64 lat; int a; int b' \u003e\u003e synthetic_events   # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\\       onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\\       \u003e\u003e events/sched/sched_switch/trigger   # cat events/sched/sched_waking/trigger   hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active]   hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active]  The second histogram is the one created for 'prio'. It is still active and still counting.  out_free reaches destroy_field_var_hists(), which frees the field_var_hists[] entries, but never unregister_field_var_hists(), which is what removes the triggers and runs only from event_hist_trigger_free(). The entry is freed and the trigger is left with nothing tracking it.  Unregister the field variable histograms in out_free as well, and record each one as soon as its trigger is registered rather than after the lookup that follows it, so no exit can leave a registered trigger untracked. The entry then belongs to field_var_hists[] and is released by destroy_field_var_hists(), so freeing it on that exit would be a double free.",
  "id": "DEBIAN-CVE-2026-99234",
  "modified": "2026-11-03T04:47:25.132853235Z",
  "published": "2026-11-02T16:17:48.597Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99234"
    }
  ],
  "upstream": [
    "CVE-2026-99234"
  ]
}