{"id":"CVE-2026-99233","kind":"vulnerability","aliases":["CVE-2026-99233"],"related":[],"title":"Linux kernel: histogram cleanup can free a live synthetic trace event","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref.","summary":"A bug in the Linux kernel tracing histogram code matches synthetic events by name only, so registering or removing a histogram on an unrelated trace event can drop a synthetic event's reference count. The synthetic event can then be freed while a histogram still points to it, which can lead to a use-after-free in the kernel.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftrace","linux-kernel","runtime","self-hosted"],"not_affected_if":["default-config","no-kernel-tracing"],"how_to_check":"- Run uname -r and compare against your distribution's kernel advisory for CVE-2026-99233 (fixed versions not yet published in sources read).\n- Exposure needs tracing: check /sys/kernel/tracing/synthetic_events and histogram triggers in /sys/kernel/tracing/events/*/*/trigger. Writing to tracefs normally needs root, so the risk is mainly local users with tracefs access.","fix":"Upstream patch posted to LKML (v2, 2026-10-19): 'tracing/histograms: Verify event_call identity when updating synth_event refcount'. No fixed kernel version confirmed yet; take the fixed version from your distro's kernel advisory.","status":"open","published_at":"2026-11-02T16:17:48+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:35+00:00","updated_at":"2026-11-02T16:28:30+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T16:26:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: histogram cleanup can free a live synthetic trace event","impact":"high","summary":"A bug in the Linux kernel tracing histogram code matches synthetic events by name only, so registering or removing a histogram on an unrelated trace event can drop a synthetic event's reference count. The synthetic event can then be freed while a histogram still points to it, which can lead to a use-after-free in the kernel.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ftrace","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user triggers use-after-free in the kernel, possibly escalating privileges","analyst_note":"Confirm affected kernel version ranges and the fixed commit from the NVD entry and the upstream kernel stable tree.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions from your distribution's advisory (unknown in the sources).\n- Check whether tracing is in use: look for synthetic events under `/sys/kernel/tracing/synthetic_events` and histogram triggers under `/sys/kernel/tracing/events/*/*/trigger`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-kernel-tracing","default-config"],"who_is_affected":"Systems running a Linux kernel with ftrace histogram triggers and synthetic events in use are the ones this bug touches. The sources do not name the affected kernel version ranges. Machines that never use kernel tracing histograms are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4348,"output_tokens":604,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected kernel version ranges and the fixed commit from the NVD entry and the upstream kernel stable tree.","search":"'-2026':13A,16A '-99233':14A,17A 'action':216C 'activ':214C 'adjust':134C,238C 'afterward':196C 'allow':205C 'basenam':150C,164C 'bug':27B 'call':99C,132C,227C,232C,236C 'cleanup':4A 'code':34B 'compar':147C 'count':59B,176C 'creat':193C 'cve':12A,15A 'decrement':200C 'drop':53B 'erron':169C 'event':11A,37B,51B,56B,62B,98C,104C,107C,125C,128C,131C,145C,149C,162C,168C,173C,187C,191C,208C,226C,235C 'file':130C,234C 'find':123C,143C,224C 'follow':91C 'found':141C 'free':6A,82B 'freed':66B,211C 'ftrace':18B 'hist':108C,112C 'histogram':3A,33B,46B,69B,116C,155C,179C,215C 'hold':218C 'host':25B 'ident':100C 'increment':204C 'introduc':223C 'kernel':2A,21B,31B,85B,89C 'lead':76B 'linux':1A,20B,30B,88C 'linux-kernel':19B 'live':8A 'look':121C 'match':35B,139C,165C,203C,233C 'modifi':170C 'name':39B,129C 'non':159C,185C 'non-synthet':158C,184C 'pars':110C 'path':120C 'point':71B 'pointer':220C 'ref':136C,198C,240C 'refcount':105C 'refer':58B,175C 'regist':42B,151C,181C 'registr':117C 'remov':44B,153C,195C 'resolv':95C 'runtim':22B 'se':135C,197C,231C,239C 'self':24B 'self-host':23B 'still':70B,217C 'synth':103C,124C,144C,225C 'synthet':9A,36B,55B,61B,160C,167C,172C,186C,190C,207C 'trace':10A,32B,50B,127C,161C 'tracing/histograms':96C 'trigger':109C 'unreg':113C 'unregistr':119C 'unrel':49B 'updat':102C 'use':80B,126C 'use-after-fre':79B 'verifi':97C,229C 'vulner':92C 'whose':163C 'without':201C","nicknames":[],"mitigations":[],"who_affected":"Linux kernels with ftrace histogram triggers and synthetic events enabled, where someone can write to tracefs (usually root or a privileged container). The bug was introduced by the commit that added synthetic events (4b147936fa50); exact affected version ranges are not yet published. Hosts that never use kernel tracing histograms, or where tracefs is not accessible to untrusted users, can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ftrace","high","linuxkernel","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99233","severity":null,"published_at":"2026-11-02T16:17:48+00:00","modified_at":"2026-11-02T16:17:48+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99233:1393","url":null,"severity":null,"published_at":"2026-11-02T16:28:30+00:00","modified_at":"2026-11-02T16:28:30+00:00","first_seen_at":"2026-11-02T16:28:30+00:00","fetched_at":"2026-11-02T16:28:30+00:00","note":"NVD/cve.org give only the kernel.org description. Found the upstream patch (Lee Jones, v2, 2026-10-19, adds find_synth_event_call(), Fixes 4b147936fa50, Cc stable) on LKML. No merged commit hash or fixed stable versions found, so fix and ranges stay unknown. Nothing marked verified."}],"documents":[{"id":52855,"url":"https://lists.openwall.net/linux-kernel/2026/10/19/1365","title":"[PATCH v2] tracing/histograms: Verify event_call identity when updating synth_event refcount","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52856,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99233","title":"NVD CVE-2026-99233","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}