Use-after-free in Linux kernel - CVE-2026-99235

Vulnerability identifier: #VU158723

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-99235

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service and potentially execute arbitrary code in kernel context or disclose sensitive kernel information.

The vulnerability exists due to use-after-free in the Linux kernel tracing histogram implementation when removing histogram triggers. A local user can remove a compatible histogram while a target histogram still retains a pointer to it, then remove the target to trigger a dereference of freed memory, causing a kernel crash and potentially enabling arbitrary code execution or sensitive information disclosure.

Linux kernel
openEuler
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo

Install security update from vendor's repository.

kernel - update to 5.10.0-341.0.0.242
bpftool - update to 5.10.0-341.0.0.242
bpftool-debuginfo - update to 5.10.0-341.0.0.242
kernel-debuginfo - update to 5.10.0-341.0.0.242
kernel-debugsource - update to 5.10.0-341.0.0.242
kernel-devel - update to 5.10.0-341.0.0.242
kernel-headers - update to 5.10.0-341.0.0.242
kernel-source - update to 5.10.0-341.0.0.242
kernel-tools - update to 5.10.0-341.0.0.242
kernel-tools-debuginfo - update to 5.10.0-341.0.0.242
kernel-tools-devel - update to 5.10.0-341.0.0.242
perf - update to 5.10.0-341.0.0.242
perf-debuginfo - update to 5.10.0-341.0.0.242
python3-perf - update to 5.10.0-341.0.0.242
python3-perf-debuginfo - update to 5.10.0-341.0.0.242

• https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436
• https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea
• https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254
• https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909
• https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e
• https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997
• https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba
• https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82

• Use-after-free in Linux kernel trace
• openEuler 22.03 LTS SP4 update for kernel