Linux Kernel CVE-2026-99233

Requires a kernel built with histogram-trigger support (CONFIG_HIST_TRIGGERS) and local access to the ftrace/tracefs event-trigger interface (typically /sys/kernel/tracing), which is normally privileged. The specific trigger stated in the description: a histogram must be registered on a NON-synthetic trace event whose basename matches a synthetic event BEFORE that synthetic event is created, and then removed AFTERWARDS - this ordering causes se->ref to be decremented without a matching increment, freeing the synthetic event while an active histogram action still holds a pointer. Limiting factors: exploitation is local-only (no remote vector), needs the attacker to control the event-registration/removal sequence and to engineer a name collision, and depends on access to the tracing subsystem rather than any default network-facing service.

This is a local-only Linux kernel use-after-free in the tracing/histogram subsystem, and the signals are internally consistent rather than conflicting. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates an attacker already on the system with some privilege and the ability to reach the ftrace/tracefs histogram-trigger interface; there is no network vector. No EPSS score was provided, there is no CISA KEV listing (so this is NOT confirmed actively exploited), and no PoC or exploit reference appears in the input - the six references are all git.kernel.org stable commits (the fix), not exploit code. The vuln.today decision label is 'this_week', which is an elevated-but-not-emergency priority consistent with a patched, locally-exploitable kernel UAF rather than a mass-exploited internet-facing flaw. Net assessment: a genuine local privilege-escalation/kernel-memory-corruption risk worth patching on schedule, but not an emergency - real-world exploitation is gated by needing privileged access to tracefs and a precise event-registration sequence, and no in-the-wild activity is evidenced. Note one labeling tension: the input Tags mark this 'Information Disclosure', whereas the described primitive (freeing a synth_event while an active histogram action still holds a pointer) is a use-after-free that typically enables more than disclosure; treat the impact tag as understating the mechanism.

A local, low-privileged user with access to the ftrace histogram-trigger interface registers a histogram on a non-synthetic trace event whose basename collides with a synthetic event, then creates and later removes the synthetic event; because the refcount was decremented without a matching increment, the synthetic event is freed while an active histogram action still references it, producing a use-after-free in kernel memory. Given AV:L/AC:L, this requires only local access and a controllable event-registration sequence, no user interaction. No public exploit identified at time of analysis.