CVE-2026-23088

A NULL pointer dereference vulnerability was found in the Linux kernel's tracing subsystem when using synthetic events with stacktrace fields. When a synthetic event is created based on another synthetic event that contains a stacktrace field, the stacktrace field is incorrectly treated as a normal field instead of a dynamic array. This causes trace_event_raw_event_synth() to dereference invalid memory when the event is enabled.

This vulnerability requires root privileges to configure synthetic tracing events through debugfs/tracefs. The specific trigger involves chaining synthetic events with stacktrace fields in histogram triggers. While the crash is reproducible with the described sequence, it requires deliberate configuration of complex tracing rules.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.