CVE-2026-99235: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99235 is a use-after-free vulnerability in the Linux kernel's tracing subsystem, specifically within the histogram field variable handling code. The flaw exists in create_field_var_hist(), which incorrectly saves a pointer to a compatible histogram (hist_data) rather than the event file, allowing the referenced memory to be freed while still in use. It affects Linux kernel versions from 4.17 onward, with fixes backported to stable releases 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, and 7.3.1. The vulnerability was disclosed on November 2, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-825 (Expired Pointer Dereference). In create_field_var_hist(), the function calls find_compatible_hist() to locate an existing histogram whose keys match the new one, then stores that histogram pointer in var_hist->hist_data. However, find_compatible_hist() matches solely on keys and may select a histogram with no variable references of its own; check_var_refs() then returns false, allowing a user to remove that histogram trigger while the target still holds a pointer to it. When unregister_field_var_hists() later dereferences hist_data->field_var_hists[i]->hist_data->event_file, it accesses freed kernel memory, triggering a KASAN-detected slab-use-after-free. The fix replaces the saved histogram pointer with a direct pointer to the event file, which persists across trigger removal operations (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to cause kernel memory corruption via access to freed slab memory, which can result in kernel panics (denial of service) or, in more sophisticated scenarios, arbitrary code execution within the kernel context. The confidentiality, integrity, and availability impacts are all rated High, as kernel-level code execution could expose sensitive system data, allow privilege escalation, and destabilize the host. The vulnerability is confined to the local system scope and does not directly enable remote exploitation or lateral movement (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to interact with the kernel tracing subsystem (e.g., access to /sys/kernel/debug/tracing).

Update the Linux kernel to a patched stable release: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, or 7.3.1. The fix modifies create_field_var_hist() to save the event file pointer directly in var_hist->hist_data instead of the compatible histogram pointer, ensuring the reference remains valid after trigger removal. As a workaround where patching is not immediately possible, restricting unprivileged access to the kernel tracing subsystem (e.g., setting kernel.perf_event_paranoid or restricting access to /sys/kernel/debug/tracing) can reduce exposure (GitHub Advisory, Red Hat Bugzilla).