{"id":"CVE-2026-99233","summary":"tracing/histograms: Verify event_call identity when updating synth_event refcount","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Verify event_call identity when updating synth_event refcount\n\nIn event_hist_trigger_parse() and hist_unreg_all(), the histogram\nregistration and unregistration paths look up find_synth_event() using\ntrace_event_name(file-\u003eevent_call) and adjust se-\u003eref if a match is\nfound.\n\nBecause find_synth_event() only compares the event basename, registering\nor removing a histogram on a non-synthetic trace event whose basename\nmatches a synthetic event erroneously modifies the synthetic event's\nreference count.  If a histogram is registered on the non-synthetic\nevent before the synthetic event is created and removed afterwards,\nse-\u003eref is decremented without a matching increment, allowing the\nsynthetic event to be freed while an active histogram action still holds\na pointer to it.\n\nIntroduce find_synth_event_call() to verify that &se-\u003ecall matches\nfile-\u003eevent_call before adjusting se-\u003eref.","modified":"2026-11-10T17:27:00.718516930Z","published":"2026-11-02T16:06:40.643Z","related":["openSUSE-SU-2026:12497-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99233.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99233.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99233"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4b147936fa509650beaf638b331573c23ba4d609"},{"fixed":"381f543ed35c434d5b707369aa5dcd69ecf440af"},{"fixed":"4472579bd1c83708b6fe623c870cdf728e947205"},{"fixed":"23b4106e8b35823acc79e206c7745f55b9cfd78b"},{"fixed":"06e816bed499fe47f39f12044382cc5d064485fb"},{"fixed":"5597bb8db6855fcb97a67196d227fea359bcd81c"},{"fixed":"cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4"},{"fixed":"3403d9bb27ebc3572bd048620746b4414e073bf9"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99233.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.161"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.115"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.60"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99233.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}