Linux Kernel Histogram Refcount Exploit via Incorrect Event Call Verification
CVE-2026-99233 Published on November 2, 2026
tracing/histograms: Verify event_call identity when updating synth_event refcount
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Verify event_call identity when updating synth_event refcount
In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.
Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count. If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.
Introduce find_synth_event_call() to verify that &se->call matches
file->event_call before adjusting se->ref.
Products Associated with CVE-2026-99233
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 4b147936fa509650beaf638b331573c23ba4d609 and below 381f543ed35c434d5b707369aa5dcd69ecf440af is affected.
- Version 4b147936fa509650beaf638b331573c23ba4d609 and below 4472579bd1c83708b6fe623c870cdf728e947205 is affected.
- Version 4b147936fa509650beaf638b331573c23ba4d609 and below 23b4106e8b35823acc79e206c7745f55b9cfd78b is affected.
- Version 4b147936fa509650beaf638b331573c23ba4d609 and below 06e816bed499fe47f39f12044382cc5d064485fb is affected.
- Version 4b147936fa509650beaf638b331573c23ba4d609 and below 5597bb8db6855fcb97a67196d227fea359bcd81c is affected.
- Version 4b147936fa509650beaf638b331573c23ba4d609 and below cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4 is affected.
- Version 4.17 is affected.
- Before 4.17 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.