CVE-2026-68283
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A use-after-free vulnerability was found in the Linux kernel's tracing subsystem, specifically in freeing trigger private data after synchronization was deferred to a separate thread. This allows a concurrent tracepoint handler to access freed memory. The fix restores synchronization for histograms and adds an optional callback for enable triggers.
Risk Assessment
The vulnerability can lead to kernel memory corruption, potentially causing system crashes or privilege escalation. Organizations using tracing features are at risk of system instability.
Recommendation
Apply the kernel patch addressing CVE-2026-68283 immediately. If patching is not possible, restrict access to tracing interfaces and monitor for unusual system behavior.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") moved the kfree() of event_trigger_data to a kthread that runs tracepoint_synchronize_unregister() before freeing. That removed the synchronization the trigger .free callbacks used to get implicitly and inline from trigger_data_free(). event_hist_trigger_free(), event_hist_trigger_named_free() and event_enable_trigger_free() free their satellite data (hist_data, cmd_ops, enable_data) right after trigger_data_free() returns. With the synchronization now deferred to the kthread, a concurrent tracepoint handler can still reach that data through the list_del_rcu()'d trigger, causing a use-after-free. The histogram teardown must stay synchronous: remove_hist_vars() and unregister_field_var_hists() have to detach a synthetic event from the histogram before the trigger-removal write returns, otherwise a following command races in and the synthetic-event removal fails with -EBUSY, as the trigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait with the correct barrier - tracepoint_synchronize_unregister(), matching the free kthread - before freeing. The enable trigger has no such synchronous requirement, and a blocking synchronize there would re-serialize the path that commit deliberately deferred. Give it an optional private_data_free() callback that the free kthread runs after its grace period, and free enable_data from there.