CVE-2026-99233 in Linux
Summary
by MITRE • 11/02/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Verify event_call identity when updating synth_event refcount
In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look up find_synth_event() using trace_event_name(file->event_call) and adjust se->ref if a match is found.
Because find_synth_event() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it.
Introduce find_synth_event_call() to verify that &se->call matches file->event_call before adjusting se->ref.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The Linux kernel tracing subsystem contains a reference counting vulnerability within the synthetic event histogram implementation, specifically affecting how trace events are registered and unregistered for histogram analysis. This flaw arises from an insufficient identity verification process during the lookup of synthetic events when managing their lifecycle references. The core issue is located in two primary code paths: event_hist_trigger_parse(), which handles the registration of histograms on trace points, and hist_unreg_all(), which manages the cleanup and removal of these registrations. In both scenarios, the kernel attempts to locate a corresponding synth_event structure by comparing the name of the current file's event_call against known synthetic events using find_synth_event().
The technical root cause lies in the comparison logic employed by find_synth_event(). This function performs a case-insensitive match based solely on the basename of the trace event. It does not verify that the found synth_event structure corresponds to the specific event_call instance being processed. Consequently, if a non-synthetic trace event shares its basename with an existing synthetic event, the lookup will incorrectly return the synthetic event's reference rather than identifying the mismatch. This lack of strict identity verification allows operations intended for one type of event to inadvertently affect another, creating a critical integrity failure in the kernel's internal state management.
The operational impact of this vulnerability is severe and can lead to use-after-free conditions that compromise system stability and potentially allow for privilege escalation or denial of service attacks. When a histogram is registered on a non-synthetic trace event whose name matches a synthetic one, the reference count of the synthetic event is erroneously incremented. Conversely, when such a histogram is unregistered, the reference count is decremented without having been properly matched to an actual registration of that specific synthetic event type. If this sequence occurs before the synthetic event itself has been fully created or after it has begun teardown, the reference count can drop incorrectly. This may result in the synthetic event structure being freed while active histogram actions still hold pointers to it. Accessing these dangling pointers leads to memory corruption, kernel panics, or unpredictable behavior as the system attempts to operate on deallocated memory regions.
This vulnerability aligns with CWE-416, Use After Free, due to the potential for accessing memory after it has been released, and CWE-20, Improper Input Validation, specifically regarding the failure to validate that the input event call matches the expected synthetic event type before modifying state. From a threat modeling perspective using MITRE ATT&CK techniques, this flaw could be leveraged in conjunction with other vulnerabilities for privilege escalation or service disruption by triggering kernel crashes through crafted trace point configurations. The lack of strict object identity checks is a common pattern in complex subsystems where multiple entity types share naming conventions but require distinct lifecycle management.
To mitigate this vulnerability, the Linux kernel developers have introduced a new helper function named find_synth_event_call(). This updated lookup mechanism verifies that the event call pointer within the found synth_event structure matches the file's event_call exactly before adjusting the reference count. By enforcing strict identity verification at the point of registration and unregistration, the kernel ensures that reference counts are only modified for events that genuinely correspond to the operation being performed. System administrators should ensure their kernels are updated with this patch applied. For environments where immediate patching is not feasible, restricting access to tracefs and monitoring for unusual histogram registrations on non-synthetic events can provide limited defensive visibility against exploitation attempts involving crafted trace point names.