CVE-2026-99235
Received Received - Intake

Use-After-Free in Linux Kernel Tracing Subsystem

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram create_field_var_hist() creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: hist_data = find_compatible_hist(target_hist_data, file); ... /* Save the compatible histogram information */ var_hist->hist_data = hist_data; hist_data is not the histogram it creates. It is one that was already there, whose keys the new one copies. The saved pointer has a single user, unregister_field_var_hists(), which runs when the target is removed: file = hist_data->field_var_hists[i]->hist_data->event_file; find_compatible_hist() matches on keys alone, so it can pick one with no variables of its own. check_var_refs() then returns false and the user can remove it while the target still points at it: BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320 Read of size 8 at addr ffff8880093b90e0 by task init/1 Freed by task 1: kfree+0x154/0x420 event_hist_trigger_free+0x1d5/0x320 event_hist_trigger_parse+0x35f3/0x69e0 trigger_process_regex+0x1a6/0x250 Save the event file instead. It is all the dereference ever wanted, and it does not go away when the user removes a trigger.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99235

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 02205a6752f223779a1b0e9e8ffacbea6e717851
Linux Linux 4.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the tracing subsystem. The bug occurs when a histogram is saved incorrectly during event variable handling. Specifically, a pointer to a compatible histogram is stored instead of the event file, leading to a dangling reference. When the original histogram is freed, the saved pointer becomes invalid, causing a slab-use-after-free error when accessed later.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and requires kernel-level inspection. Detection involves checking kernel logs for KASAN slab-use-after-free errors related to event_hist_trigger_free. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i kasan to search for relevant errors.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code or cause a denial-of-service condition on the affected system. It may lead to kernel memory corruption, crashes, or privilege escalation if exploited. Systems running vulnerable Linux kernel versions are at risk.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's tracing subsystem, which could lead to memory corruption and potential arbitrary code execution. While it does not directly impact data protection standards like GDPR or HIPAA, such vulnerabilities can indirectly affect compliance by compromising system integrity, leading to unauthorized access or data breaches if exploited.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the primary mitigation. Monitor vendor advisories for kernel updates and reboot the system after applying patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...