---
id: "CVE-2026-99233"
kind: "vulnerability"
aliases: ["CVE-2026-99233"]
title: "Linux kernel: histogram cleanup can free a live synthetic trace event"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ftrace", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-kernel-tracing"]
published_at: "2026-11-02T16:17:48+00:00"
first_seen_at: "2026-11-02T16:24:06+00:00"
updated_at: "2026-11-02T16:28:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99233", "first_seen_at": "2026-11-02T16:24:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:28:30+00:00"}]
---

# Linux kernel: histogram cleanup can free a live synthetic trace event

A bug in the Linux kernel tracing histogram code matches synthetic events by name only, so registering or removing a histogram on an unrelated trace event can drop a synthetic event's reference count. The synthetic event can then be freed while a histogram still points to it, which can lead to a use-after-free in the kernel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run uname -r and compare against your distribution's kernel advisory for CVE-2026-99233 (fixed versions not yet published in sources read).
- Exposure needs tracing: check /sys/kernel/tracing/synthetic_events and histogram triggers in /sys/kernel/tracing/events/*/*/trigger. Writing to tracefs normally needs root, so the risk is mainly local users with tracefs access.

## Fix

Upstream patch posted to LKML (v2, 2026-10-19): 'tracing/histograms: Verify event_call identity when updating synth_event refcount'. No fixed kernel version confirmed yet; take the fixed version from your distro's kernel advisory.

## Timeline

- 2026-11-02T16:24:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99233
- 2026-11-02T16:28:30+00:00 analyst — NVD/cve.org give only the kernel.org description. Found the upstream patch (Lee Jones, v2, 2026-10-19, adds find_synth_event_call(), Fixes 4b147936fa50, Cc stable) on LKML. No merged commit hash or fixed stable versions found, so fix and ranges stay unknown. Nothing marked verified.

## Documents

- [describes] NVD CVE-2026-99233 https://nvd.nist.gov/vuln/detail/CVE-2026-99233
- [fix] [PATCH v2] tracing/histograms: Verify event_call identity when updating synth_event refcount https://lists.openwall.net/linux-kernel/2026/10/19/1365

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tracing/histograms: Verify event_call identity when updating synth_event refcount

In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.

Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count.  If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.

Introduce find_synth_event_call() to verify that &se->call matches
file->event_call before adjusting se->ref.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_