GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89746 (GCVE-0-2026-89746)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
tracing: Fix use-after-free with same-name named triggers
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77 , < 441aa6742dff70297b5f64533a07a6189a026e91 (git)
Affected: 43b254d46c740bf9dbe65709afa021dd726dfa99 , < 3a8534664426c071c2dfb5b4ffa36b18a2abfd79 (git)
Affected: 435d2964af815aae456db554c62963b4515f19d0 , < 477d762be4b0ffaf01429ccd88859e93b0ec28cc (git)
Affected: 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e , < b1a49c22de01faf176d44e5caa765e237353a579 (git)
Affected: 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e , < 83d1ae0406d8eade219a81b401e201702dd9dc55 (git)
Affected: 6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e , < a7318172aa332a161fb9618286e64454c827f8fd (git)
Affected: f1ae50cfb818ce1ac7a674406dfadb7653e2552d (git)
Affected: 6.1.130 , < 6.1.188 (semver)
Affected: 6.6.81 , < 6.6.157 (semver)
Affected: 6.12.18 , < 6.12.109 (semver)
Affected: 6.13.6 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_hist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "441aa6742dff70297b5f64533a07a6189a026e91",
              "status": "affected",
              "version": "5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77",
              "versionType": "git"
            },
            {
              "lessThan": "3a8534664426c071c2dfb5b4ffa36b18a2abfd79",
              "status": "affected",
              "version": "43b254d46c740bf9dbe65709afa021dd726dfa99",
              "versionType": "git"
            },
            {
              "lessThan": "477d762be4b0ffaf01429ccd88859e93b0ec28cc",
              "status": "affected",
              "version": "435d2964af815aae456db554c62963b4515f19d0",
              "versionType": "git"
            },
            {
              "lessThan": "b1a49c22de01faf176d44e5caa765e237353a579",
              "status": "affected",
              "version": "6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e",
              "versionType": "git"
            },
            {
              "lessThan": "83d1ae0406d8eade219a81b401e201702dd9dc55",
              "status": "affected",
              "version": "6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e",
              "versionType": "git"
            },
            {
              "lessThan": "a7318172aa332a161fb9618286e64454c827f8fd",
              "status": "affected",
              "version": "6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1ae50cfb818ce1ac7a674406dfadb7653e2552d",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.81",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.109",
              "status": "affected",
              "version": "6.12.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_hist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.81",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.12.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free with same-name named triggers\n\nWhen two hist triggers on different events are registered with the same\nname=, the second one reuses the first as named_data.  Both are added to\ntr-\u003ehist_vars by save_hist_vars() during event_hist_trigger_parse(),\nbecause save_hist_vars() is called before event_trigger_register() while\nthe named reuse is only detected later, in hist_register_trigger().\n\nIn the named-data branch hist_register_trigger() then frees the second\nhistogram\u0027s hist_data via destroy_hist_data(), but never removes its\ntr-\u003ehist_vars list entry, leaving a dangling pointer and leaking the\ntrace_array reference it holds.\n\nA later hist trigger that references a variable makes find_var_file()\nwalk tr-\u003ehist_vars and dereference the freed hist_data.  The bug is\nreproducible from userspace by writing three hist triggers to tracefs:\n\n  cd /sys/kernel/tracing\n  echo \u0027hist:keys=common_pid:x=common_pid:name=mh\u0027 \u003e events/sched/sched_switch/trigger\n  echo \u0027hist:keys=common_pid:x=common_pid:name=mh\u0027 \u003e events/sched/sched_process_fork/trigger\n  echo \u0027hist:keys=common_pid:vals=$x\u0027 \u003e events/sched/sched_process_exit/trigger\n\nThe third write panics the kernel:\n\n  BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290\n  Read of size 8 at addr ffff888001f8a0e0 by task sh/1\n  CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G      D          N\n  Call Trace:\n    find_var_file.part.0\n    find_event_var\n    parse_atom\n    parse_expr\n    __create_val_field\n    event_hist_trigger_parse\n    trigger_process_regex\n    event_trigger_write\n    vfs_write\n    ksys_write\n    do_syscall_64\n    entry_SYSCALL_64_after_hwframe\n  Allocated by task 1:\n    event_hist_trigger_parse\n  Freed by task 1:\n    hist_register_trigger+0x618/0xa30\n    event_hist_trigger_parse\n  The buggy address belongs to freed 2048-byte region\n  Oops: general protection fault ... RIP: find_var_file.part.0\n  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n\nFix by removing the hist_data from tr-\u003ehist_vars and releasing the\ntrace_array reference in the named-data branch of hist_register_trigger()\nbefore freeing the hist_data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only by writing hist trigger commands to tracefs event trigger files via write(2) (event_trigger_write -\u003e event_hist_trigger_parse). There is no network, adjacent-radio, or physical-device path into hist_register_trigger() or find_var_file().\nAC:L - Triggering is fully deterministic: two sequential same-name named hist writes free hist_data while leaving it on tr-\u003ehist_vars, and a third vals=$x write walks that dangling pointer. No race or victim state is required, and CONFIG_HIST_TRIGGERS is standard in distro and Android kernels.\nPR:L - The path has no capable() check; event_trigger_open() only enforces LOCKDOWN_TRACEFS and DAC (TRACE_MODE_WRITE 0640). Tracefs is routinely delegated to non-root tracing users (Android/Perfetto, ChromeOS debugd, gid= tracing mounts), matching prior named-hist UAF scores (CVE-2025-21899).\nUI:N - The attacker performs all three trigger writes themselves; no victim action, mount, or cooperating process is required.\nS:U - The slab use-after-free corrupts kernel heap objects in the tracing subsystem within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - find_var_file() and find_var_field() dereference the freed 2048-byte hist_trigger_data (event_file, fields[]). After reclaiming that slab, the attacker controls those pointers, and create_var_ref() persists var_field-\u003ehist_data for later tracing_map reads, yielding an arbitrary kernel read primitive.\nI:H - The dangling hist_vars entry plus a sprayed hist_trigger_data lets create_var_ref() store attacker-controlled hist_data/map pointers into the new trigger; event_hist_trigger()/resolve_var_refs() then write tracing_map state through those pointers, a heap write primitive suitable for control-flow hijack.\nA:H - The commit reproduces a KASAN slab-use-after-free in find_var_file() that oopses or panics the kernel (including killing init). Any use-after-free of hist_data is a reliable whole-system crash even without successful exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:27.816Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/441aa6742dff70297b5f64533a07a6189a026e91"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a8534664426c071c2dfb5b4ffa36b18a2abfd79"
        },
        {
          "url": "https://git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579"
        },
        {
          "url": "https://git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd"
        }
      ],
      "title": "tracing: Fix use-after-free with same-name named triggers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89746",
    "datePublished": "2026-09-11T19:46:51.529Z",
    "dateReserved": "2026-09-11T19:38:34.762Z",
    "dateUpdated": "2026-09-14T12:02:27.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89746",
      "date": "2026-09-16",
      "epss": "0.00159",
      "percentile": "0.0549"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:52:16.000Z",
      "cve": "CVE-2026-89746",
      "id": "msrc_CVE-2026-89746",
      "initial_release_date": "2026-09-13T01:05:52.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing: Fix use-after-free with same-name named triggers",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89746.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89746\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:05.373\",\"lastModified\":\"2026-09-14T13:19:23.350\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: Fix use-after-free with same-name named triggers\\n\\nWhen two hist triggers on different events are registered with the same\\nname=, the second one reuses the first as named_data.  Both are added to\\ntr-\u003ehist_vars by save_hist_vars() during event_hist_trigger_parse(),\\nbecause save_hist_vars() is called before event_trigger_register() while\\nthe named reuse is only detected later, in hist_register_trigger().\\n\\nIn the named-data branch hist_register_trigger() then frees the second\\nhistogram\u0027s hist_data via destroy_hist_data(), but never removes its\\ntr-\u003ehist_vars list entry, leaving a dangling pointer and leaking the\\ntrace_array reference it holds.\\n\\nA later hist trigger that references a variable makes find_var_file()\\nwalk tr-\u003ehist_vars and dereference the freed hist_data.  The bug is\\nreproducible from userspace by writing three hist triggers to tracefs:\\n\\n  cd /sys/kernel/tracing\\n  echo \u0027hist:keys=common_pid:x=common_pid:name=mh\u0027 \u003e events/sched/sched_switch/trigger\\n  echo \u0027hist:keys=common_pid:x=common_pid:name=mh\u0027 \u003e events/sched/sched_process_fork/trigger\\n  echo \u0027hist:keys=common_pid:vals=$x\u0027 \u003e events/sched/sched_process_exit/trigger\\n\\nThe third write panics the kernel:\\n\\n  BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290\\n  Read of size 8 at addr ffff888001f8a0e0 by task sh/1\\n  CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G      D          N\\n  Call Trace:\\n    find_var_file.part.0\\n    find_event_var\\n    parse_atom\\n    parse_expr\\n    __create_val_field\\n    event_hist_trigger_parse\\n    trigger_process_regex\\n    event_trigger_write\\n    vfs_write\\n    ksys_write\\n    do_syscall_64\\n    entry_SYSCALL_64_after_hwframe\\n  Allocated by task 1:\\n    event_hist_trigger_parse\\n  Freed by task 1:\\n    hist_register_trigger+0x618/0xa30\\n    event_hist_trigger_parse\\n  The buggy address belongs to freed 2048-byte region\\n  Oops: general protection fault ... RIP: find_var_file.part.0\\n  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\\n\\nFix by removing the hist_data from tr-\u003ehist_vars and releasing the\\ntrace_array reference in the named-data branch of hist_register_trigger()\\nbefore freeing the hist_data.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_events_hist.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5ae1b18f05ee2b849dc03b6c15d7da0c1c6efa77\",\"lessThan\":\"441aa6742dff70297b5f64533a07a6189a026e91\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43b254d46c740bf9dbe65709afa021dd726dfa99\",\"lessThan\":\"3a8534664426c071c2dfb5b4ffa36b18a2abfd79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"435d2964af815aae456db554c62963b4515f19d0\",\"lessThan\":\"477d762be4b0ffaf01429ccd88859e93b0ec28cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e\",\"lessThan\":\"b1a49c22de01faf176d44e5caa765e237353a579\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e\",\"lessThan\":\"83d1ae0406d8eade219a81b401e201702dd9dc55\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f86bdeab633a56d5c6dccf1a2c5989b6a5e323e\",\"lessThan\":\"a7318172aa332a161fb9618286e64454c827f8fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f1ae50cfb818ce1ac7a674406dfadb7653e2552d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.130\",\"lessThan\":\"6.1.188\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.81\",\"lessThan\":\"6.6.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.18\",\"lessThan\":\"6.12.109\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.13.6\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_events_hist.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3a8534664426c071c2dfb5b4ffa36b18a2abfd79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/441aa6742dff70297b5f64533a07a6189a026e91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/477d762be4b0ffaf01429ccd88859e93b0ec28cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83d1ae0406d8eade219a81b401e201702dd9dc55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a7318172aa332a161fb9618286e64454c827f8fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b1a49c22de01faf176d44e5caa765e237353a579\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:48:15+00:00",
      "cve": "CVE-2026-89746",
      "id": "CVE-2026-89746",
      "initial_release_date": "2026-09-11T19:46:51.529000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel tracing: Use-after-free leads to Denial of Service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89746.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T00:56:34Z",
      "cve": "CVE-2026-89746",
      "id": "CVE-2026-89746",
      "initial_release_date": "2026-09-12T16:22:24Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89746",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89746.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.