# CVE-2026-99140: tracing: Fix hist trigger timestamps for buffered events

CVE-2026-99140 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99140, released November 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-99140
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 28, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99140

## Description

In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix hist trigger timestamps for buffered events  Syzkaller triggered a WARN_ON_ONCE(!nest) warning:    WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp   Call trace:     ring_buffer_event_time_stamp     hist_field_timestamp     hist_fn_call     event_hist_trigger     event_triggers_call     __event_trigger_test_discard     trace_event_buffer_commit     do_trace_event_raw_event_sched_switch     trace_event_raw_event_sched_switch  The warning is probabilistically reproducible and is related to syzkaller executing the following commands:    echo 'prev_pid == 999999' > events/sched/sched_switch/filter   echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger  The specific triggering process is as follows:  CPU 0                                           CPU 1 (context switching)                             (echo 'hist:keys=common_timestamp' > \                                                         events/sched/sched_switch/trigger) do_trace_event_raw_event_##call   trace_event_buffer_lock_reserve     if (!tr->no_filter_buffering_ref &&         trace_file->flags & EVENT_FILE_FL_FILTERED)         return entry;  // return directly                                                 event_hist_trigger_parse                                                   hist_register_trigger                                                     tracing_set_filter_buffering(file->tr, true);                                                       tr->no_filter_buffering_ref++;     __trace_buffer_lock_reserve       rb_start_commit         local_inc(&cpu_buffer->committing);  // skipped and not executed   trace_event_buffer_commit     __event_trigger_test_discard       event_triggers_call         event_hist_trigger           hist_fn_call             hist_field_timestamp               ring_buffer_event_time_stamp                 nest = local_read(&cpu_buffer->committing);                 WARN_ON_ONCE(!nest)  // trigger warning  The root cause is that when an event file has a filter attached and the hist trigger has not yet been attached, trace_event_buffer_lock_reserve() writes the event into the per-CPU trace_buffered_event temp buffer instead of reserving it in the ring buffer, so cpu_buffer->committing is not incremented. When the event is later processed at commit time by a hist trigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a zero committing count, triggering WARN_ON_ONCE(!nest).  tracing_event_time_stamp() was added by commit d8279bfc5e959 ("tracing: Add tracing_event_time_stamp() API") for exactly this case: if the event is the per-CPU trace_buffered_event, it returns the current ring buffer timestamp. But it never gained a caller. Use it in hist_field_timestamp(), so that a hist trigger that races onto a buffered event records the current time, which is only marginally later than when the event was recorded, instead of warning and recording a bogus timestamp.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-99140](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99140.md) | Nov 3, 2026 |
| Linux | linux Debian 14 | 7.2.13-1 | [DEBIAN-CVE-2026-99140](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99140.md) | Nov 3, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.