Live › vulnerability › CVE-2026-99233
A bug in the Linux kernel tracing histogram code matches synthetic events by name only, so registering or removing a histogram on an unrelated trace event can drop a synthetic event's reference count. The synthetic event can then be freed while a histogram still points to it, which can lead to a use-after-free in the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Linux kernels with ftrace histogram triggers and synthetic events enabled, where someone can write to tracefs (usually root or a privileged container). The bug was introduced by the commit that added synthetic events (4b147936fa50); exact affected version ranges are not yet published. Hosts that never use kernel tracing histograms, or where tracefs is not accessible to untrusted users, can mostly skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Verify event_call identity when updating synth_event refcount
In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look up find_synth_event() using trace_event_name(file->event_call) and adjust se->ref if a match is found.
Because find_synth_event() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it.
Introduce find_synth_event_call() to verify that &se->call matches file->event_call before adjusting se->ref.
This page as .md · .json · in your agent: get_signal("CVE-2026-99233")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.