{"id":"CVE-2026-99233","revision":"a3a683cb44ee4525b4d4a58b260d1047","records":[{"revision":"a3a683cb44ee4525b4d4a58b260d1047","observedAt":"2026-11-03T21:57:16.832+00:00","statement":{"source":"cve-program","id":"CVE-2026-99233","aliases":[],"title":"tracing/histograms: Verify event_call identity when updating synth_event refcount","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref.","state":0,"publishedAt":"2026-11-02T16:06:40.643+00:00","modifiedAt":"2026-11-03T19:13:02.404+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\",\n                        \"kernel/trace/trace_events_synth.c\",\n                        \"kernel/trace/trace_synth.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"381f543ed35c434d5b707369aa5dcd69ecf440af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"4472579bd1c83708b6fe623c870cdf728e947205\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"23b4106e8b35823acc79e206c7745f55b9cfd78b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"06e816bed499fe47f39f12044382cc5d064485fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"5597bb8db6855fcb97a67196d227fea359bcd81c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4b147936fa509650beaf638b331573c23ba4d609\",\n                            \"lessThan\": \"3403d9bb27ebc3572bd048620746b4414e073bf9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\",\n                        \"kernel/trace/trace_events_synth.c\",\n                        \"kernel/trace/trace_synth.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.60\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.14\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3.1\",\n                            \"lessThanOrEqual\": \"7.3.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.4-rc1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af","https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205","https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b","https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb","https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c","https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99233","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99233","identifiers":["CVE-2026-99233"]},"retained":false,"historicalAffected":[]}],"coverage":[]}