{"id":"CVE-2026-99140","kind":"vulnerability","aliases":["CVE-2026-99140"],"related":[],"title":"Linux kernel: tracing histogram timestamp race triggers kernel warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix hist trigger timestamps for buffered events\n\nSyzkaller triggered a WARN_ON_ONCE(!nest) warning:\n\n  WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp\n  Call trace:\n    ring_buffer_event_time_stamp\n    hist_field_timestamp\n    hist_fn_call\n    event_hist_trigger\n    event_triggers_call\n    __event_trigger_test_discard\n    trace_event_buffer_commit\n    do_trace_event_raw_event_sched_switch\n    trace_event_raw_event_sched_switch\n\nThe warning is probabilistically reproducible and is related to syzkaller\nexecuting the following commands:\n\n  echo 'prev_pid == 999999' > events/sched/sched_switch/filter\n  echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger\n\nThe specific triggering process is as follows:\n\nCPU 0                                           CPU 1\n(context switching)                             (echo 'hist:keys=common_timestamp' > \\\n                                                        events/sched/sched_switch/trigger)\ndo_trace_event_raw_event_##call\n  trace_event_buffer_lock_reserve\n    if (!tr->no_filter_buffering_ref &&\n        trace_file->flags & EVENT_FILE_FL_FILTERED)\n        return entry;  // return directly\n                                                event_hist_trigger_parse\n                                                  hist_register_trigger\n                                                    tracing_set_filter_buffering(file->tr, true);\n                                                      tr->no_filter_buffering_ref++;\n    __trace_buffer_lock_reserve\n      rb_start_commit\n        local_inc(&cpu_buffer->committing);  // skipped and not executed\n  trace_event_buffer_commit\n    __event_trigger_test_discard\n      event_triggers_call\n        event_hist_trigger\n          hist_fn_call\n            hist_field_timestamp\n              ring_buffer_event_time_stamp\n                nest = local_read(&cpu_buffer->committing);\n                WARN_ON_ONCE(!nest)  // trigger warning\n\nThe root cause is that when an event file has a filter attached and the\nhist trigger has not yet been attached, trace_event_buffer_lock_reserve()\nwrites the event into the per-CPU trace_buffered_event temp buffer instead\nof reserving it in the ring buffer, so cpu_buffer->committing is not\nincremented. When the event is later processed at commit time by a hist\ntrigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a\nzero committing count, triggering WARN_ON_ONCE(!nest).\n\ntracing_event_time_stamp() was added by commit d8279bfc5e959 (\"tracing:\nAdd tracing_event_time_stamp() API\") for exactly this case: if the event\nis the per-CPU trace_buffered_event, it returns the current ring buffer\ntimestamp. But it never gained a caller. Use it in hist_field_timestamp(),\nso that a hist trigger that races onto a buffered event records the\ncurrent time, which is only marginally later than when the event was\nrecorded, instead of warning and recording a bogus timestamp.","summary":"A race in the Linux kernel tracing subsystem lets a histogram trigger attached to a filtered event hit a WARN_ON_ONCE and record a wrong timestamp. The sources describe a kernel warning and a bogus timestamp, not code execution or data exposure.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:07+00:00","updated_at":"2026-10-28T11:36:07+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:36:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: tracing histogram timestamp race triggers kernel warning","impact":"low","summary":"A race in the Linux kernel tracing subsystem lets a histogram trigger attached to a filtered event hit a WARN_ON_ONCE and record a wrong timestamp. The sources describe a kernel warning and a bogus timestamp, not code execution or data exposure.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel warning and wrong trace timestamp; no code execution described","analyst_note":"Check the kernel.org stable commit for affected and fixed versions; the sources give no version ranges.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with ftrace event tracing and histogram triggers on events with filters; the sources do not name affected versions. Machines that do not use kernel tracing histograms are unlikely to be affected. The sources do not say who can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000646,"input_tokens":4326,"output_tokens":427,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-99140':12A,15A '0':174C '1':176C '821':94C '999999':158C 'add':376C,381C 'api':386C 'attach':35B,297C,306C 'bogus':58B,453C 'buffer':82C,97C,104C,126C,193C,200C,223C,230C,233C,242C,250C,269C,277C,309C,321C,324C,332C,335C,357C,400C,407C,430C 'call':101C,113C,119C,190C,258C,264C 'caller':414C 'case':390C 'caus':287C 'code':61B 'command':154C 'commit':127C,238C,243C,251C,278C,336C,347C,364C,378C 'common':163C,182C 'context':177C 'count':365C 'cpu':173C,175C,241C,276C,319C,334C,398C 'current':405C,434C 'cve':10A,13A 'd8279bfc5e959':379C 'data':64B 'describ':52B 'direct':212C 'discard':123C,255C 'echo':155C,160C,179C 'entri':210C 'event':39B,83C,98C,105C,114C,117C,120C,125C,130C,132C,136C,138C,187C,189C,192C,205C,213C,249C,252C,256C,259C,270C,292C,308C,314C,322C,342C,358C,372C,383C,393C,401C,431C,444C 'events/sched/sched_switch/filter':159C 'events/sched/sched_switch/trigger':165C,184C 'exact':388C 'execut':62B,151C,247C 'exposur':65B 'field':109C,266C,354C,419C 'file':203C,206C,224C,293C 'filter':38B,199C,208C,222C,229C,296C 'fix':77C 'fl':207C 'flag':204C 'fn':112C,263C 'follow':71C,153C,172C 'gain':412C 'hist':78C,108C,111C,115C,161C,180C,214C,217C,260C,262C,265C,300C,351C,353C,418C,424C 'histogram':4A,33B 'hit':40B 'host':22B 'inc':240C 'increment':339C 'instead':325C,447C 'kernel':2A,8A,18B,28B,54B,69C 'kernel/trace/ring_buffer.c':93C 'key':162C,181C 'later':344C,440C 'let':31B 'linux':1A,17B,27B,68C 'linux-kernel':16B 'local':239C,274C 'lock':194C,234C,310C 'margin':439C 'nest':90C,273C,282C,370C 'never':411C 'onto':428C 'pars':216C 'per':318C,397C 'per-cpu':317C,396C 'pid':157C 'prev':156C 'probabilist':144C 'process':169C,345C 'race':6A,24B,427C 'raw':131C,137C,188C 'rb':236C 'read':275C 'record':46B,432C,446C,451C 'ref':201C,231C 'regist':218C 'relat':148C 'reproduc':145C 'reserv':195C,235C,311C,327C 'resolv':75C 'return':209C,211C,403C 'ring':96C,103C,268C,331C,356C,406C 'root':286C 'runtim':19B 'sched':133C,139C 'see':361C 'self':21B 'self-host':20B 'set':221C 'skip':244C 'sourc':51B 'specif':167C 'stamp':100C,107C,272C,360C,374C,385C 'start':237C 'subsystem':30B 'switch':134C,140C,178C 'syzkal':84C,150C 'temp':323C 'test':122C,254C 'time':99C,106C,271C,348C,359C,373C,384C,435C 'timestamp':5A,49B,59B,80C,110C,164C,183C,267C,355C,408C,420C,454C 'tr':197C,225C,227C 'trace':3A,29B,76C,102C,124C,129C,135C,186C,191C,202C,220C,232C,248C,307C,320C,371C,380C,382C,399C 'trigger':7A,34B,79C,85C,116C,118C,121C,168C,215C,219C,253C,257C,261C,283C,301C,352C,366C,425C 'true':226C 'use':415C 'vulner':72C 'warn':9A,42B,55B,87C,91C,92C,142C,279C,284C,367C,449C 'write':312C 'wrong':48B 'yet':304C 'zero':363C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with ftrace event tracing and histogram triggers on events with filters; the sources do not name affected versions. Machines that do not use kernel tracing histograms are unlikely to be affected. The sources do not say who can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99140","severity":null,"published_at":"2026-10-28T11:17:33+00:00","modified_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}