In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Fix memory leak problem
This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.
As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list.
However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed;
IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+-----------
These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed.
If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger
Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-docUpgrade kernel-debugUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-zfcpdump-modules-extraUpgrade libperfUpgrade rtlaUpgrade kernel-rt-64k-modules-extraUpgrade kernel-modulesUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-headersUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-develUpgrade kernel-rt-64k-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernelUpgrade kernel-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-develUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rtUpgrade kernel-64k-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-modules-coreUpgrade rvUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-64k-develUpgrade kernel-64k-modules-extraUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-cross-headersUpgrade kernel-debug-uki-virtUpgrade perfUpgrade kernel-tools-libsUpgrade kernel-64kUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade perfUpgrade kernel-toolsUpgrade kernel-develUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-headers | Jul 11, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade python3-perf | Jun 11, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Jun 11, 2025 | Feb 26, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Feb 26, 2025 |
| Rocky_linux | — | Upgrade kernelUpgrade kernel-rt-debugUpgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-develUpgrade kernel-devel-matchedUpgrade kernel-zfcpdumpUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-debuginfoUpgrade libperfUpgrade rtlaUpgrade kernel-debugUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-uki-virtUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade libperf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-develUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-devel-matched | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-intel-iotg-5.15Upgrade linux-aws-5.15Upgrade linux-oracle-5.4Upgrade linux-gkeUpgrade linux-gcpUpgrade linux-nvidiaUpgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-ibmUpgrade linux-riscv-5.15Upgrade linux-aws-fipsUpgrade linux-oracleUpgrade linux-gkeopUpgrade linux-azure-5.15Upgrade linux-lowlatencyUpgrade linux-oracle-5.15Upgrade linux-fipsUpgrade linux-realtimeUpgrade linux-aws-5.4Upgrade linux-iotUpgrade linux-gcp-fipsUpgrade linux-hwe-5.15Upgrade linux-azureUpgrade linux-lowlatency-hwe-5.15Upgrade linuxUpgrade linux-raspiUpgrade linux-azure-5.4Upgrade linux-gcp-5.4Upgrade linux-ibm-5.4Upgrade linux-raspi-5.4Upgrade linux-azure-fipsUpgrade linux-bluefieldUpgrade linux-awsUpgrade linux-hwe-5.4 | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub