{"id":"CVE-2026-99235","kind":"vulnerability","aliases":["CVE-2026-99235"],"related":[],"title":"Linux kernel: histogram removal lets tracing code read freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist->hist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data->field_var_hists[i]->hist_data->event_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n  kfree+0x154/0x420\n  event_hist_trigger_free+0x1d5/0x320\n  event_hist_trigger_parse+0x35f3/0x69e0\n  trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.","summary":"In the Linux kernel's tracing histogram code, a field-variable histogram keeps a pointer to another histogram that the user can remove, so the pointer can dangle. Reading the freed memory on teardown can crash the system or, in principle, let a local user with tracing access influence kernel memory.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftrace","linux-kernel","linux-servers","runtime","use-after-free"],"not_affected_if":["default-config","no-hist-triggers","no-tracing-access","tracefs-root-only"],"how_to_check":"- Run uname -r and compare with your distribution's kernel advisory for CVE-2026-99235.\n- Exposure needs CONFIG_HIST_TRIGGERS and a user who can write to tracefs (usually root): check grep HIST_TRIGGERS /boot/config-$(uname -r), and ls -l /sys/kernel/tracing/events/sched/sched_switch/trigger for who can write.\n- Also check if any tool or script writes hist: triggers with onmatch() / field variables.","fix":"Apply the upstream patch 'tracing: Save the event file instead of the compatible histogram' (kernel/trace/trace_events_hist.c). Fixed kernel versions and the stable commit are not yet published in anything I read; take the fixed version from your distribution's kernel update.","status":"open","published_at":"2026-11-02T16:17:48+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:31+00:00","updated_at":"2026-11-02T16:28:32+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T16:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: histogram removal lets tracing code read freed memory","impact":"high","summary":"In the Linux kernel's tracing histogram code, a field-variable histogram keeps a pointer to another histogram that the user can remove, so the pointer can dangle. Reading the freed memory on teardown can crash the system or, in principle, let a local user with tracing access influence kernel memory.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","linux-servers","ftrace"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"kernel memory use-after-free could crash the machine or be abused locally","analyst_note":"Find the affected and fixed kernel version ranges and the stable commit from the kernel.org or NVD entry for CVE-2026-99235.","how_to_check":"- `uname -r` and compare against the fixed kernel versions listed by your distribution\n- Check whether tracing histograms are in use: `cat /sys/kernel/tracing/events/*/*/trigger` (unknown whether this is the right path on every system)","plain_action":"","needs_analyst":true,"not_affected_if":["no-tracing-access","default-config"],"who_is_affected":"Only systems running a Linux kernel with the ftrace/event histogram triggers in use, where a user with access to the tracing interface can create and remove histogram triggers. The sources do not say which kernel versions are affected or whether a default configuration enables the path. Systems without tracing access for untrusted users are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4525,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed kernel version ranges and the stable commit from the kernel.org or NVD entry for CVE-2026-99235.","search":"'+0':249C,266C,272C,278C,283C '-2026':12A,15A '-99235':13A,16A '1':264C '8':254C 'access':77B 'addr':256C 'alon':206C 'alreadi':163C 'anoth':46B 'away':302C 'bug':237C 'check':218C 'code':7A,36B 'compat':99C,133C,141C,201C 'copi':170C 'crash':65B 'creat':101C,105C,157C 'cve':11A,14A 'dangl':57B 'data':131C,137C,147C,149C,151C,191C,197C 'derefer':294C 'event':94C,111C,198C,245C,268C,274C,287C 'ever':295C 'fals':223C 'ffff8880093b90e0':257C 'field':39B,102C,115C,179C,192C 'field-vari':38B 'file':95C,138C,189C,199C,288C 'find':132C,200C 'follow':86C 'free':28B,243C,248C,271C 'freed':9A,60B,261C 'ftrace':17B 'go':301C 'hist':104C,130C,134C,136C,145C,146C,148C,150C,181C,190C,194C,196C,202C,246C,269C,275C 'histogram':3A,35B,41B,47B,100C,107C,142C,155C 'influenc':78B 'inform':143C 'init/1':260C 'instead':96C,289C 'kasan':238C 'keep':42B 'kernel':2A,20B,32B,79B,84C 'key':166C,205C 'kfree':265C 'later':129C 'let':5A,71B 'linux':1A,19B,22B,31B,83C 'linux-kernel':18B 'linux-serv':21B 'local':73B 'match':110C,203C 'memori':10A,61B,80B 'new':168C 'one':160C,169C,211C 'pars':277C 'pick':210C 'point':234C 'pointer':44B,55B,173C 'principl':70B 'process':281C 'read':8A,58B,251C 'record':118C 'ref':220C 'regex':282C 'remov':4A,52B,188C,228C,306C 'resolv':90C 'return':222C 'run':183C 'runtim':24B 'save':92C,139C,172C,285C 'server':23B 'singl':176C 'size':253C 'slab':240C 'slab-use-after-fre':239C 'still':233C 'suppli':113C 'system':67B 'target':122C,135C,186C,232C 'task':259C,263C 'teardown':63B 'torn':127C 'trace':6A,34B,76B,91C 'trigger':247C,270C,276C,280C,308C 'unregist':178C 'use':26B,241C 'use-after-fre':25B 'user':50B,74B,177C,226C,305C 'var':103C,144C,180C,193C,219C 'variabl':40B,116C,214C 'vulner':87C 'want':296C 'whose':165C 'x154/0x420':267C 'x1a6/0x250':284C 'x1d5/0x320':273C 'x2b2/0x320':250C 'x35f3/0x69e0':279C","nicknames":[],"mitigations":[],"who_affected":"Linux kernels built with histogram triggers (CONFIG_HIST_TRIGGERS) where someone can write to tracefs, which is normally root only. The bug is in field-variable (inter-event) histograms: removing the histogram they copy keys from leaves a dangling pointer, read as freed memory when the target histogram is removed. Affected kernel versions are not stated in the sources I read; the flawed code came in with the field variables commit 02205a6752f2. Systems where untrusted users cannot reach tracefs can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ftrace","high","linuxkernel","linuxservers","runtime","useafterfree"],"first_public_at":"2026-11-02T16:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99235","severity":null,"published_at":"2026-11-02T16:17:48+00:00","modified_at":"2026-11-02T16:17:48+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99235:1392","url":null,"severity":null,"published_at":"2026-11-02T16:28:32+00:00","modified_at":"2026-11-02T16:28:32+00:00","first_seen_at":"2026-11-02T16:28:32+00:00","fetched_at":"2026-11-02T16:28:32+00:00","note":"Read the kernel patch thread (v1 patch by Donggeun Yoo, Acked-by Tom Zanussi, Cc stable, Fixes: 02205a6752f2 'tracing: Add support for field variables'). Reproducer is local via tracefs (needs write access to tracing, normally root). Found no merged stable commit hash and no fixed kernel versions; NVD page returned nothing and no kernel.org CVE announcement was found. Nothing marked verified."}],"documents":[{"id":52857,"url":"https://lists.openwall.net/linux-kernel/2026/09/20/1185","title":"Re: [PATCH] tracing: Save the event file instead of the compatible histogram (Acked-by Tom Zanussi)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":52862,"url":"https://ci.syzbot.org/series/be7da91c-90fc-4a2c-a784-fedb8277c3c8","title":"Syzbot CI: patch series for the fix","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}