CVE-2026-99233: tracing/histograms: Verify event_call identity when updating synth_event refcount
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Verify eventcall identity when updating synthevent refcount
In eventhisttriggerparse() and histunregall(), the histogram registration and unregistration paths look up findsynthevent() using traceeventname(file->eventcall) and adjust se->ref if a match is found.
Because findsynthevent() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it.
Introduce findsyntheventcall() to verify that &se->call matches file->eventcall before adjusting se->ref.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.161 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.115 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.60 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.14 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Frequently Asked Questions
What conditions are required to trigger the reference-count error?
A histogram must be registered on a non-synthetic trace event whose basename matches that of a synthetic event. The non-synthetic histogram must be registered before the synthetic event is created and removed afterward, causing a decrement without the corresponding increment.
What is the practical impact if the condition is met?
The synthetic event can be freed while an active histogram action still retains a pointer to it. This creates a use-after-free condition affecting confidentiality, integrity, and availability.
Which Ubuntu kernel package variants are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.