Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-11-02T16:06:40 kernel: kernel: Privilege escalation via use-after-free in tracing subsystem 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-825

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify event_call identity when updating synth_event refcount In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look up find_synth_event() using trace_event_name(file->event_call) and adjust se->ref if a match is found. Because find_synth_event() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it. Introduce find_synth_event_call() to verify that &se->call matches file->event_call before adjusting se->ref.

A flaw was found in the Linux kernel's event tracing subsystem. The kernel fails to properly verify the unique identity of trace events when updating reference counters for histogram triggers, comparing only their names. A local user with access to the tracing interface can exploit this by registering and removing triggers on conflicting event names, causing the kernel to release memory while it is still in use (use-after-free). This flaw can allow an attacker to achieve local privilege escalation, execute arbitrary code, or cause a system crash resulting in a Denial of Service (DoS).

This vulnerability is rated as Important because successful exploitation allows a local attacker to corrupt kernel memory and achieve full administrative takeover or system crashes without victim interaction. In default Red Hat Enterprise Linux configurations, the kernel tracing file hierarchy is restricted to root users, limiting exposure on typical production hosts. The issue primarily impacts multi-tenant setups or environments where permissions to manipulate tracing triggers have been explicitly delegated to less privileged accounts. --- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to restrict local access to the kernel tracing file hierarchy (tracefs) to prevent manipulation of histogram triggers: upgrade to the corresponding fixed Red Hat builds, which introduce find_synth_event_call to verify that &se->call matches file->event_call before adjusting se->ref, closing histogram trigger manipulation on non-synthetic trace events matching synthetic event names. Until patched, this is only a concern on Linux systems where local users or delegated accounts have access to the kernel tracing interface — non-Linux platforms are unaffected — so restrict and audit permissions on the kernel tracing interface (tracefs) so unprivileged or untrusted users cannot register or remove histogram triggers. As a compensating measure, deploy runtime memory error detection such as KASAN to detect slab use-after-free conditions at runtime, enable SLAB freelist hardening including randomization and pointer integrity validation to impede heap grooming, enforce SELinux policies to restrict unauthorized processes from accessing tracefs and manipulating histogram triggers, drop administrative capabilities in unprivileged sandboxes and containers to prevent access to kernel tracing interfaces, enable kernel address space layout randomization to hinder predictable execution redirection following memory corruption, and enforce supervisor mode execution prevention to block execution of userspace payloads during kernel execution hijacking. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free reference counting defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium) Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Affected openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99233 https://nvd.nist.gov/vuln/detail/CVE-2026-99233 https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205 https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4