Linux Kernel CVE-2026-99235

Requires a kernel built with histogram triggers (CONFIG_HIST_TRIGGERS) and local access to the ftrace event-trigger interface under tracefs (typically /sys/kernel/tracing/events/.../trigger), which on standard distributions is writable only by root/CAP_SYS_ADMIN - this is the primary limiting factor and is in tension with the input's PR:L. The attacker must also perform a specific sequence: create a histogram whose keys match an existing event but that has no variables of its own, create a target histogram with a field variable via create_field_var_hist() that selects that compatible histogram (find_compatible_hist matches on keys alone), then remove the compatible trigger - check_var_refs() fails to protect it, so unregister_field_var_hists() later dereferences freed memory. Not remotely reachable (AV:L); no network path and no unauthenticated vector.

This is a use-after-free in the Linux kernel's ftrace histogram-trigger subsystem (event_hist_trigger_free), confirmed by the KASAN slab-use-after-free splat in the description and by eight upstream stable fix commits on git.kernel.org. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) signals a local, low-complexity, full-CIA-impact memory-corruption bug - consistent with kernel UAF that can be steered toward privilege escalation. However, the signals point to constrained real-world risk rather than mass exploitation: the vuln.today decision label is 'this_week' (not act_now/emergency), there is no CISA KEV listing, no EPSS score was supplied, and no public exploit or PoC reference is present - the KASAN trace is a crash report, not an exploit. One tension to verify: the vector states PR:L, yet the trigger path lives under tracefs (/sys/kernel/tracing), which is normally writable only by root/CAP_SYS_ADMIN, so the realistic privilege prerequisite is likely higher than PR:L implies - verify the tracefs permission model in the target deployment. CWE is marked N/A in the input but the description and KASAN output unambiguously describe a use-after-free (CWE-416). Net: a legitimate kernel memory-corruption fix worth patching on a normal cadence, but not an in-the-wild emergency on current evidence.

A local user with the ability to write ftrace histogram triggers creates a 'compatible' histogram (matched on keys alone, with no variables of its own), then creates a target histogram with a field variable that references it, then removes the compatible trigger - which is freed while the target still holds a pointer to it, producing a use-after-free on teardown that an attacker can shape toward kernel memory corruption and privilege escalation. No public exploit or PoC reference was identified at time of analysis; only the upstream crash (KASAN) report and fix commits are available. Exploitation is local (AV:L) and low-complexity (AC:L) once the attacker can reach the histogram-trigger interface.