CVE-2026-99233: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99233 is a use-after-free / expired pointer dereference vulnerability in the Linux kernel's tracing/histograms subsystem, specifically in the histogram registration and unregistration paths (event_hist_trigger_parse() and hist_unreg_all()). The flaw arises because find_synth_event() compares only the event basename, allowing a non-synthetic trace event with a matching name to erroneously modify a synthetic event's reference count (se->ref), ultimately freeing the synthetic event while an active histogram action still holds a pointer to it. It was published on November 2, 2026, and affects Linux kernel versions from commit 4b147936fa50 onward across multiple stable branches. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-825 (Expired Pointer Dereference) with an estimated CWE-416 (Use After Free) impact. In event_hist_trigger_parse() and hist_unreg_all(), the kernel looks up a synthetic event using find_synth_event(trace_event_name(file->event_call)), which performs only a basename comparison. If a histogram is registered on a non-synthetic trace event whose basename coincidentally matches a synthetic event, se->ref is decremented without a prior matching increment. This allows the synthetic event structure to be freed while a histogram action still holds a live pointer to it, creating a use-after-free condition in kernel memory. The fix introduces find_synth_event_call(), which additionally verifies that &se->call matches file->event_call before adjusting the reference count (GitHub Advisory, EUVD).

A local attacker with low privileges can exploit this vulnerability to trigger a use-after-free condition in kernel memory, potentially enabling arbitrary code execution with kernel-level privileges. Successful exploitation could result in full system compromise, including high confidentiality, integrity, and availability impact on the affected host. Lateral movement to other systems or containers sharing the same kernel is also a realistic consequence in multi-tenant or containerized environments (GitHub Advisory, Red Hat).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is reported at 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to interact with the kernel's tracing/histogram interface, which is typically restricted but accessible to users with CAP_TRACING or equivalent permissions on many default Linux configurations.

1. Gain local access: Obtain a low-privilege local shell on a vulnerable Linux system (kernel version ≥ commit 4b147936fa50, unpatched).
2. Identify target synthetic event: Enumerate existing synthetic trace events via /sys/kernel/tracing/synthetic_events to find a target event name (e.g., my_synth_event).
3. Register histogram on non-synthetic event: Using the tracing filesystem, register a histogram trigger on a non-synthetic trace event that shares the same basename as the synthetic event (e.g., write to /sys/kernel/tracing/events/<subsystem>/my_synth_event/trigger).
4. Create and then remove the synthetic event: Create the synthetic event via /sys/kernel/tracing/synthetic_events, then remove it. This causes se->ref to be decremented without a matching increment, freeing the synthetic event structure.
5. Trigger use-after-free: With the histogram action still holding a dangling pointer to the freed synthetic event, trigger the histogram action (e.g., by generating the relevant trace event). The kernel dereferences the freed memory.
6. Achieve kernel code execution: Leverage the use-after-free primitive with heap spray or other kernel exploitation techniques to redirect execution flow and escalate to root privileges (GitHub Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing use-after-free warnings, KASAN/KFENCE reports referencing event_hist_trigger_parse, hist_unreg_all, or find_synth_event; unexpected kernel oops or BUG traces in the tracing subsystem.
• File System: Unusual writes to /sys/kernel/tracing/events/*/trigger or /sys/kernel/tracing/synthetic_events by non-root or non-administrative users; unexpected histogram trigger files created on non-synthetic trace events.
• Process: Unexpected privilege escalation (processes transitioning to UID 0); unusual processes spawned from low-privilege users with kernel capabilities.
• Network: Outbound connections from newly privileged processes following interaction with the tracing subsystem (potential post-exploitation activity).

Apply the upstream kernel patches available for the affected stable branches: Linux 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, and 7.3.1 (GitHub Advisory, Red Hat). Red Hat has tracked this issue under Bugzilla #2565289. As a workaround where kernel updates cannot be deployed immediately, restrict access to the kernel tracing filesystem (/sys/kernel/tracing/) using security policies (e.g., SELinux, AppArmor, or filesystem permissions) to limit which users can register histogram triggers. Disabling the CONFIG_HIST_TRIGGERS kernel option at build time also eliminates the attack surface if recompilation is feasible.

The vulnerability was noted on Mastodon/infosec.exchange shortly after disclosure, with at least one researcher (@suriq) flagging it. Coverage has been primarily automated, appearing across vulnerability aggregators such as VulnDB, CVEfeed, and radar.offseq.com. No major vendor statements beyond Red Hat's advisory tracking have been observed, and community reaction has been low-key given the absence of a public PoC or active exploitation (Red Hat).