AZL-112565: CVE-2026-99233 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Verify eventcall identity when updating synthevent refcount
In eventhisttriggerparse() and histunregall(), the histogram registration and unregistration paths look up findsynthevent() using traceeventname(file->eventcall) and adjust se->ref if a match is found.
Because findsynthevent() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it.
Introduce findsyntheventcall() to verify that &se->call matches file->eventcall before adjusting se->ref.
Affected Software
Event History
Frequently Asked Questions
What configuration is required for this issue to be reachable?
The affected system must use kernel tracing histograms and synthetic events. Exploitation depends on a non-synthetic trace event and a synthetic event sharing the same basename, with histogram registration and removal occurring in the order described.
What does an attacker need to do to trigger the unsafe reference-count change?
They need to register a histogram on a non-synthetic trace event whose basename matches a synthetic event, before that synthetic event is created, then remove the histogram afterward. This can decrement the synthetic event reference count without a corresponding increment while an active histogram action retains a pointer to it.
What is the impact if the condition is triggered?
The synthetic event can be freed while an active histogram action still holds a pointer to it. This creates a dangling-pointer condition in the kernel tracing subsystem.
How can I determine whether a system may be exposed?
Review tracing histogram and synthetic-event configurations for non-synthetic and synthetic trace events with identical basenames. Systems not using these tracing features do not meet the described trigger conditions.