{"id":"CVE-2026-99235","aliases":[],"cve":{"records":[{"id":"CVE-2026-99235","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T10:25:14.402Z","published":"2026-11-02T16:06:41.510Z","modified":"2026-11-03T19:13:03.627Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-11-03T19:13:03.627Z"}],"references":[{"url":"https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"6.18.60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"7.2.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"7.3.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.17","versionEndExcluding":"7.4-rc1"}]}]}]}],"prioritization":[]},"title":"tracing: Save the event file instead of the compatible histogram","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Save the event file instead of the compatible histogram\n\ncreate_field_var_hist() creates a histogram on the matched event to\nsupply a field variable, and records it on the target so it can be torn\ndown later:\n\n\thist_data = find_compatible_hist(target_hist_data, file);\n\t...\n\t/* Save the compatible histogram information */\n\tvar_hist->hist_data = hist_data;\n\nhist_data is not the histogram it creates. It is one that was already\nthere, whose keys the new one copies. The saved pointer has a single\nuser, unregister_field_var_hists(), which runs when the target is\nremoved:\n\n\tfile = hist_data->field_var_hists[i]->hist_data->event_file;\n\nfind_compatible_hist() matches on keys alone, so it can pick one with no\nvariables of its own. check_var_refs() then returns false and the user\ncan remove it while the target still points at it:\n\n BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320\n Read of size 8 at addr ffff8880093b90e0 by task init/1\n\n Freed by task 1:\n  kfree+0x154/0x420\n  event_hist_trigger_free+0x1d5/0x320\n  event_hist_trigger_parse+0x35f3/0x69e0\n  trigger_process_regex+0x1a6/0x250\n\nSave the event file instead. It is all the dereference ever wanted, and\nit does not go away when the user removes a trigger.","score":7.8,"severity":"high","published":"2026-11-02T16:06:41.510Z","modified":"2026-11-03T19:13:03.627Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"a6165126b1a1b26342b55be6eb6ee23af8756aba","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"173914501b97236d7ea7dc2af7f30feddd4e1436","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"ac815a379644b2ad5008a009a3516ada31b5dd82","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"8b307d64a60548e4a74cb746f74d7ed4bd49965e","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"7a111ba0d1b74c99bc8f096565dc71945f694254","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"9631dbccd3c649b567a5aafffea6b00634183997","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"7cafc82e6153f05a221be678cd649d02e06ba909","versionType":"git"},{"version":"02205a6752f223779a1b0e9e8ffacbea6e717851","status":"affected","lessThan":"d5c42664fc094899af9aae5300b27fe8fdb658ef","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99235"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"4.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.17","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.161","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.115","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.60","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.14","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3.1","status":"unaffected","lessThanOrEqual":"7.3.*","versionType":"semver"},{"version":"7.4-rc1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99235"}],"remediation":[],"references":["https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef"],"sources":[{"name":"CVE","id":"CVE-2026-99235","modified":"2026-11-03T19:13:03.627Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-99235"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-11-03T19:50:42.535Z","kev":{"status":"not-listed","checkedAt":"2026-11-06T21:20:33.816Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-02T16:45:35.380Z","attemptedAt":"2026-11-02T16:45:35.380Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-02T16:45:35.677Z","attemptedAt":"2026-11-02T16:45:35.677Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-02T16:45:35.923Z","attemptedAt":"2026-11-02T16:45:35.923Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-02T16:45:35.376Z","attemptedAt":"2026-11-02T16:45:35.376Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-99235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99235","modified":"2026-11-02T16:17:48.790","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-02T16:45:35.380Z"}],"aiSummary":{"text":"The Linux kernel has a vulnerability where the create_field_var_hist function saves a pointer to a compatible histogram, which can be freed while still in use, leading to a use-after-free error. The affected versions are Linux kernel versions starting from 4.17. The vulnerability requires access to the kernel's tracing system.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T20:01:14.406Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-99235"}]}}