Use-after-free in Linux kernel - CVE-2026-99233

Vulnerability identifier: #VU158725

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-99233

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially execute arbitrary code in kernel context, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a use-after-free caused by incorrect synthetic-event reference counting in the Linux kernel tracing histogram subsystem when registering or unregistering histograms on non-synthetic events with basenames matching synthetic events. A local user can register a histogram on a non-synthetic event before creating a same-named synthetic event and remove the histogram afterwards to prematurely free the synthetic event while an active histogram action retains a pointer to it, potentially enabling arbitrary kernel code execution, sensitive information disclosure, or a kernel crash.

Linux kernel
openEuler
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo

Install security update from vendor's repository.

kernel - update to 5.10.0-341.0.0.242
bpftool - update to 5.10.0-341.0.0.242
bpftool-debuginfo - update to 5.10.0-341.0.0.242
kernel-debuginfo - update to 5.10.0-341.0.0.242
kernel-debugsource - update to 5.10.0-341.0.0.242
kernel-devel - update to 5.10.0-341.0.0.242
kernel-headers - update to 5.10.0-341.0.0.242
kernel-source - update to 5.10.0-341.0.0.242
kernel-tools - update to 5.10.0-341.0.0.242
kernel-tools-debuginfo - update to 5.10.0-341.0.0.242
kernel-tools-devel - update to 5.10.0-341.0.0.242
perf - update to 5.10.0-341.0.0.242
perf-debuginfo - update to 5.10.0-341.0.0.242
python3-perf - update to 5.10.0-341.0.0.242
python3-perf-debuginfo - update to 5.10.0-341.0.0.242

• https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb
• https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b
• https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af
• https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205
• https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c
• https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4

• Use-after-free in Linux kernel trace
• openEuler 22.03 LTS SP4 update for kernel