UBUNTU-CVE-2026-99233: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse() and histunregall(), the histogram registration and unregistration paths look up findsynthevent() using traceeventname(file->eventcall) and adjust se->ref if a match is found. Because findsynthevent() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it. Introduce findsyntheventcall() to verify that &se->call matches file->eventcall before adjusting se->ref.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The severity vector indicates local access with low privileges and no user interaction. Exploitation involves creating and removing histogram registrations in tracing paths involving synthetic and non-synthetic events with the same basename.
What is the likely impact if exploitation succeeds?
An incorrect synthetic-event reference-count decrement can free a synthetic event while an active histogram action still retains a pointer to it. The provided severity vector rates confidentiality, integrity, and availability impact as high.
Which Ubuntu packages are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
How can I determine whether my system has the vulnerable condition?
The vulnerable condition requires a non-synthetic trace event and a synthetic event that share the same basename, along with histogram registration and removal in the described order. The supplied data does not provide fixed package versions or a runtime detection method.