CVE-2026-68283
Received Received - Intake

Use-After-Free in Linux Kernel Tracing Subsystem

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") moved the kfree() of event_trigger_data to a kthread that runs tracepoint_synchronize_unregister() before freeing. That removed the synchronization the trigger .free callbacks used to get implicitly and inline from trigger_data_free(). event_hist_trigger_free(), event_hist_trigger_named_free() and event_enable_trigger_free() free their satellite data (hist_data, cmd_ops, enable_data) right after trigger_data_free() returns. With the synchronization now deferred to the kthread, a concurrent tracepoint handler can still reach that data through the list_del_rcu()'d trigger, causing a use-after-free. The histogram teardown must stay synchronous: remove_hist_vars() and unregister_field_var_hists() have to detach a synthetic event from the histogram before the trigger-removal write returns, otherwise a following command races in and the synthetic-event removal fails with -EBUSY, as the trigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait with the correct barrier - tracepoint_synchronize_unregister(), matching the free kthread - before freeing. The enable trigger has no such synchronous requirement, and a blocking synchronize there would re-serialize the path that commit deliberately deferred. Give it an optional private_data_free() callback that the free kthread runs after its grace period, and free enable_data from there.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68283
EUVD
EUVD-2026-55384

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's tracing subsystem. It occurs when trigger private data is freed prematurely due to a missing synchronization step. The issue arises because the freeing of event_trigger_data was moved to a kthread that runs after tracepoint_synchronize_unregister(), removing implicit synchronization. This allows concurrent tracepoint handlers to access freed data, causing a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and requires kernel-level inspection. Detection involves checking kernel logs for tracepoint-related errors or crashes, particularly during histogram or trigger operations. Commands like dmesg, journalctl -k, or checking for kernel oops messages may reveal use-after-free errors in tracing components.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. It specifically affects the Linux kernel's tracing functionality, which is used for debugging and monitoring. Attackers might leverage this to execute arbitrary code or cause denial-of-service conditions on affected systems.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. Avoid using histogram-based tracing or event triggers until patched. Monitor kernel logs for suspicious activity related to tracing subsystems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart