{"id":"CVE-2026-99233","title":"tracing/histograms: Verify event_call identity when updating synth_event refcount","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and un…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 381f543ed35c434d5b707369aa5dcd69ecf440af","Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 4472579bd1c83708b6fe623c870cdf728e947205","Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 23b4106e8b35823acc79e206c7745f55b9cfd78b","Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 06e816bed499fe47f39f12044382cc5d064485fb","Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 5597bb8db6855fcb97a67196d227fea359bcd81c","Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 3403d9bb27ebc3572bd048620746b4414e073bf9","Linux 4.17"],"published":"2026-11-02","updated":"2026-11-03","sourceUpdated":"2026-11-03T19:13:02.404Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99233","references":[{"url":"https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af"},{"url":"https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205"},{"url":"https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b"},{"url":"https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb"},{"url":"https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c"},{"url":"https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4"},{"url":"https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9"}],"tags":["cve.org"],"epss":0.00121,"epssPercentile":0.01889,"ingestedAt":"2026-11-05T20:33:06.387Z","slug":"CVE-2026-99233","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file->event_call) and adjust se->ref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse->ref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se->call matches\nfile->event_call before adjusting se->ref.\n\n## Affected\n\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 381f543ed35c434d5b707369aa5dcd69ecf440af`\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 4472579bd1c83708b6fe623c870cdf728e947205`\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 23b4106e8b35823acc79e206c7745f55b9cfd78b`\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 06e816bed499fe47f39f12044382cc5d064485fb`\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 5597bb8db6855fcb97a67196d227fea359bcd81c`\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4`\n- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 3403d9bb27ebc3572bd048620746b4414e073bf9`\n- `Linux 4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}