CVE-2026-99235
Description
A flaw was found in the Linux kernel's event tracing subsystem. A local user with permissions to configure trace event triggers could exploit this flaw to achieve privilege escalation or cause a Denial of Service (DoS). The issue occurs when the kernel improperly retains a reference to compatible histogram data, allowing that data to be freed while still referenced by another trigger. When the remaining trigger is subsequently unregistered, the kernel accesses the freed memory, resulting in a use-after-free condition that can crash the system or enable unauthorized code execution.
Statement
Red Hat has evaluated this vulnerability as having an Important severity impact because successful exploitation can allow a local user to compromise the kernel space or trigger a system-wide denial of service, elevating privileges beyond standard user boundaries. On typical Red Hat Enterprise Linux installations, the event tracing filesystem interface is protected by default file permissions and restricted to administrative accounts, which inherently limits general exposure. However, in environments where tracing capabilities or filesystem permissions are explicitly delegated to unprivileged accounts, an attacker can manipulate event triggers to induce memory corruption.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to restrict write permissions to tracefs and event trigger configuration files to trusted administrators: upgrade to the corresponding fixed Red Hat builds, which save a direct pointer to trace_event_file instead of the compatible histogram pointer in struct field_var_hist, closing all 2 injection vectors (trace event trigger manipulation, premature deletion of a referenced compatible histogram trigger). Until patched, this is only a concern on Linux systems where local users have write permissions to configure trace event triggers — Non-Linux operating systems are unaffected — so restrict and audit write access to tracefs and event trigger control files to prevent unprivileged accounts from creating and deleting histogram triggers. As a compensating measure, enable runtime memory error detection such as KASAN or HWASan to detect slab use-after-free violations during trigger unregistration, enable KASLR to randomize kernel base addresses and hinder reliable execution redirection, enforce SMEP to prevent the kernel from executing userspace code if instruction pointers are redirected, enforce SMAP to block the kernel from accessing attacker-controlled userspace memory structures, enable Control Flow Integrity or Shadow Call Stack to validate indirect call targets within the kernel, and enable slab freelist hardening with freelist randomization and integrity checks to impede exploitation of freed heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying slab use-after-free defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
