---
id: CVE-2026-99233
title: >-
  tracing/histograms: Verify event_call identity when updating synth_event
  refcount
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  tracing/histograms: Verify event_call identity when updating synth_event
  refcount


  In event_hist_trigger_parse() and hist_unreg_all(), the histogram

  registration and un…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    381f543ed35c434d5b707369aa5dcd69ecf440af
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    4472579bd1c83708b6fe623c870cdf728e947205
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    23b4106e8b35823acc79e206c7745f55b9cfd78b
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    06e816bed499fe47f39f12044382cc5d064485fb
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    5597bb8db6855fcb97a67196d227fea359bcd81c
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4
  - >-
    Linux >= 4b147936fa509650beaf638b331573c23ba4d609 <
    3403d9bb27ebc3572bd048620746b4414e073bf9
  - Linux 4.17
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:13:02.404Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99233'
references:
  - url: 'https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af'
  - url: 'https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205'
  - url: 'https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b'
  - url: 'https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb'
  - url: 'https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c'
  - url: 'https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4'
  - url: 'https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9'
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.01889
ingestedAt: '2026-11-05T20:33:06.387Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing/histograms: Verify event_call identity when updating synth_event refcount

In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.

Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count.  If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.

Introduce find_synth_event_call() to verify that &se->call matches
file->event_call before adjusting se->ref.

## Affected

- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 381f543ed35c434d5b707369aa5dcd69ecf440af`
- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 4472579bd1c83708b6fe623c870cdf728e947205`
- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 23b4106e8b35823acc79e206c7745f55b9cfd78b`
- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 06e816bed499fe47f39f12044382cc5d064485fb`
- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 5597bb8db6855fcb97a67196d227fea359bcd81c`
- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4`
- `Linux >= 4b147936fa509650beaf638b331573c23ba4d609 < 3403d9bb27ebc3572bd048620746b4414e073bf9`
- `Linux 4.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.