---
id: "CVE-2026-99235"
kind: "vulnerability"
aliases: ["CVE-2026-99235"]
title: "Linux kernel: histogram removal lets tracing code read freed memory"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ftrace", "linux-kernel", "linux-servers", "runtime", "use-after-free"]
not_affected_if: ["default-config", "no-hist-triggers", "no-tracing-access", "tracefs-root-only"]
published_at: "2026-11-02T16:17:48+00:00"
first_seen_at: "2026-11-02T16:24:06+00:00"
updated_at: "2026-11-02T16:28:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99235", "first_seen_at": "2026-11-02T16:24:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:28:32+00:00"}]
---

# Linux kernel: histogram removal lets tracing code read freed memory

In the Linux kernel's tracing histogram code, a field-variable histogram keeps a pointer to another histogram that the user can remove, so the pointer can dangle. Reading the freed memory on teardown can crash the system or, in principle, let a local user with tracing access influence kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run uname -r and compare with your distribution's kernel advisory for CVE-2026-99235.
- Exposure needs CONFIG_HIST_TRIGGERS and a user who can write to tracefs (usually root): check grep HIST_TRIGGERS /boot/config-$(uname -r), and ls -l /sys/kernel/tracing/events/sched/sched_switch/trigger for who can write.
- Also check if any tool or script writes hist: triggers with onmatch() / field variables.

## Fix

Apply the upstream patch 'tracing: Save the event file instead of the compatible histogram' (kernel/trace/trace_events_hist.c). Fixed kernel versions and the stable commit are not yet published in anything I read; take the fixed version from your distribution's kernel update.

## Timeline

- 2026-11-02T16:24:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99235
- 2026-11-02T16:28:32+00:00 analyst — Read the kernel patch thread (v1 patch by Donggeun Yoo, Acked-by Tom Zanussi, Cc stable, Fixes: 02205a6752f2 'tracing: Add support for field variables'). Reproducer is local via tracefs (needs write access to tracing, normally root). Found no merged stable commit hash and no fixed kernel versions; NVD page returned nothing and no kernel.org CVE announcement was found. Nothing marked verified.

## Documents

- [describes] Syzbot CI: patch series for the fix https://ci.syzbot.org/series/be7da91c-90fc-4a2c-a784-fedb8277c3c8
- [fix] Re: [PATCH] tracing: Save the event file instead of the compatible histogram (Acked-by Tom Zanussi) https://lists.openwall.net/linux-kernel/2026/09/20/1185

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tracing: Save the event file instead of the compatible histogram

create_field_var_hist() creates a histogram on the matched event to
supply a field variable, and records it on the target so it can be torn
down later:

	hist_data = find_compatible_hist(target_hist_data, file);
	...
	/* Save the compatible histogram information */
	var_hist->hist_data = hist_data;

hist_data is not the histogram it creates. It is one that was already
there, whose keys the new one copies. The saved pointer has a single
user, unregister_field_var_hists(), which runs when the target is
removed:

	file = hist_data->field_var_hists[i]->hist_data->event_file;

find_compatible_hist() matches on keys alone, so it can pick one with no
variables of its own. check_var_refs() then returns false and the user
can remove it while the target still points at it:

 BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320
 Read of size 8 at addr ffff8880093b90e0 by task init/1

 Freed by task 1:
  kfree+0x154/0x420
  event_hist_trigger_free+0x1d5/0x320
  event_hist_trigger_parse+0x35f3/0x69e0
  trigger_process_regex+0x1a6/0x250

Save the event file instead. It is all the dereference ever wanted, and
it does not go away when the user removes a trigger.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_