UBUNTU-CVE-2026-68283: Use After Free
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing eventtriggerdata") moved the kfree() of eventtriggerdata to a kthread that runs tracepointsynchronizeunregister() before freeing. That removed the synchronization the trigger .free callbacks used to get implicitly and inline from triggerdatafree(). eventhisttriggerfree(), eventhisttriggernamedfree() and eventenabletriggerfree() free their satellite data (histdata, cmdops, enabledata) right after triggerdatafree() returns. With the synchronization now deferred to the kthread, a concurrent tracepoint handler can still reach that data through the listdelrcu()'d trigger, causing a use-after-free. The histogram teardown must stay synchronous: removehistvars() and unregisterfieldvarhists() have to detach a synthetic event from the histogram before the trigger-removal write returns, otherwise a following command races in and the synthetic-event removal fails with -EBUSY, as the trigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait with the correct barrier - tracepointsynchronizeunregister(), matching the free kthread - before freeing. The enable trigger has no such synchronous requirement, and a blocking synchronize there would re-serialize the path that commit deliberately deferred. Give it an optional privatedatafree() callback that the free kthread runs after its grace period, and free enabledata from there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Add an optional private_data_free() callback invoked by the freeing kthread after tracepoint_synchronize_unregister(), and move freeing of trigger satellite data (including enable_data) into that callback. Keep histogram teardown synchronous so remove_hist_vars() and unregister_field_var_hists() detach the synthetic event before the trigger-removal write returns.
Event History
Frequently Asked Questions
What concurrent condition leads to the use-after-free?
A tracepoint handler must still be able to reach a trigger after it has been removed with list_del_rcu(). The affected cleanup callbacks can free associated data before the deferred synchronization thread has ensured that concurrent handlers can no longer access it.
Which trigger cleanup paths are involved?
The affected callbacks are event_hist_trigger_free(), event_hist_trigger_named_free(), and event_enable_trigger_free(). Their associated satellite data includes hist_data, cmd_ops, and enable_data.
What teardown behavior must remain synchronous?
Histogram teardown must synchronously detach synthetic events before trigger removal returns. In particular, remove_hist_vars() and unregister_field_var_hists() must complete this detachment to avoid a later synthetic-event removal failing with -EBUSY.
Does the provided information identify affected package versions, default exposure, or a temporary mitigation?
No. The provided data lists affected Ubuntu kernel package families, but does not provide fixed or affected version ranges, default tracing configuration details, or a workaround for systems that cannot yet be updated.