CVE-2026-99233

A flaw was found in the Linux kernel's event tracing subsystem. The kernel fails to properly verify the unique identity of trace events when updating reference counters for histogram triggers, comparing only their names. A local user with access to the tracing interface can exploit this by registering and removing triggers on conflicting event names, causing the kernel to release memory while it is still in use (use-after-free). This flaw can allow an attacker to achieve local privilege escalation, execute arbitrary code, or cause a system crash resulting in a Denial of Service (DoS).

This vulnerability is rated as Important because successful exploitation allows a local attacker to corrupt kernel memory and achieve full administrative takeover or system crashes without victim interaction. In default Red Hat Enterprise Linux configurations, the kernel tracing file hierarchy is restricted to root users, limiting exposure on typical production hosts. The issue primarily impacts multi-tenant setups or environments where permissions to manipulate tracing triggers have been explicitly delegated to less privileged accounts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to restrict local access to the kernel tracing file hierarchy (tracefs) to prevent manipulation of histogram triggers: upgrade to the corresponding fixed Red Hat builds, which introduce find_synth_event_call to verify that &se->call matches file->event_call before adjusting se->ref, closing histogram trigger manipulation on non-synthetic trace events matching synthetic event names. Until patched, this is only a concern on Linux systems where local users or delegated accounts have access to the kernel tracing interface — non-Linux platforms are unaffected — so restrict and audit permissions on the kernel tracing interface (tracefs) so unprivileged or untrusted users cannot register or remove histogram triggers. As a compensating measure, deploy runtime memory error detection such as KASAN to detect slab use-after-free conditions at runtime, enable SLAB freelist hardening including randomization and pointer integrity validation to impede heap grooming, enforce SELinux policies to restrict unauthorized processes from accessing tracefs and manipulating histogram triggers, drop administrative capabilities in unprivileged sandboxes and containers to prevent access to kernel tracing interfaces, enable kernel address space layout randomization to hinder predictable execution redirection following memory corruption, and enforce supervisor mode execution prevention to block execution of userspace payloads during kernel execution hijacking. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free reference counting defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)