CVE-2026-99235

A flaw was found in the Linux kernel's event tracing subsystem. A local user with permissions to configure trace event triggers could exploit this flaw to achieve privilege escalation or cause a Denial of Service (DoS). The issue occurs when the kernel improperly retains a reference to compatible histogram data, allowing that data to be freed while still referenced by another trigger. When the remaining trigger is subsequently unregistered, the kernel accesses the freed memory, resulting in a use-after-free condition that can crash the system or enable unauthorized code execution.

Red Hat has evaluated this vulnerability as having an Important severity impact because successful exploitation can allow a local user to compromise the kernel space or trigger a system-wide denial of service, elevating privileges beyond standard user boundaries. On typical Red Hat Enterprise Linux installations, the event tracing filesystem interface is protected by default file permissions and restricted to administrative accounts, which inherently limits general exposure. However, in environments where tracing capabilities or filesystem permissions are explicitly delegated to unprivileged accounts, an attacker can manipulate event triggers to induce memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to restrict write permissions to tracefs and event trigger configuration files to trusted administrators: upgrade to the corresponding fixed Red Hat builds, which save a direct pointer to trace_event_file instead of the compatible histogram pointer in struct field_var_hist, closing all 2 injection vectors (trace event trigger manipulation, premature deletion of a referenced compatible histogram trigger). Until patched, this is only a concern on Linux systems where local users have write permissions to configure trace event triggers — Non-Linux operating systems are unaffected — so restrict and audit write access to tracefs and event trigger control files to prevent unprivileged accounts from creating and deleting histogram triggers. As a compensating measure, enable runtime memory error detection such as KASAN or HWASan to detect slab use-after-free violations during trigger unregistration, enable KASLR to randomize kernel base addresses and hinder reliable execution redirection, enforce SMEP to prevent the kernel from executing userspace code if instruction pointers are redirected, enforce SMAP to block the kernel from accessing attacker-controlled userspace memory structures, enable Control Flow Integrity or Shadow Call Stack to validate indirect call targets within the kernel, and enable slab freelist hardening with freelist randomization and integrity checks to impede exploitation of freed heap memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying slab use-after-free defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)