{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68283","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.379Z","datePublished":"2026-08-10T12:02:15.088Z","dateUpdated":"2026-08-17T05:02:18.147Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:02:18.147Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free freeing trigger private data\n\nCommit 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing\nevent_trigger_data\") moved the kfree() of event_trigger_data to a kthread\nthat runs tracepoint_synchronize_unregister() before freeing. That removed\nthe synchronization the trigger .free callbacks used to get implicitly and\ninline from trigger_data_free().\n\nevent_hist_trigger_free(), event_hist_trigger_named_free() and\nevent_enable_trigger_free() free their satellite data (hist_data, cmd_ops,\nenable_data) right after trigger_data_free() returns. With the\nsynchronization now deferred to the kthread, a concurrent tracepoint\nhandler can still reach that data through the list_del_rcu()'d trigger,\ncausing a use-after-free.\n\nThe histogram teardown must stay synchronous: remove_hist_vars() and\nunregister_field_var_hists() have to detach a synthetic event from the\nhistogram before the trigger-removal write returns, otherwise a following\ncommand races in and the synthetic-event removal fails with -EBUSY, as the\ntrigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait\nwith the correct barrier - tracepoint_synchronize_unregister(), matching\nthe free kthread - before freeing.\n\nThe enable trigger has no such synchronous requirement, and a blocking\nsynchronize there would re-serialize the path that commit deliberately\ndeferred. Give it an optional private_data_free() callback that the free\nkthread runs after its grace period, and free enable_data from there."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - Placeholder.\nAC:L - The attacker controls both sides of the race: one thread writes '!hist:'/'!enable_event:' to remove the trigger while another continuously fires the traced event, so an in-flight event_triggers_call() reader reliably touches hist_data/enable_data after they are freed inline.\nPR:L - Registering and removing triggers only needs write access to tracefs (TRACE_MODE_WRITE, DAC plus LOCKDOWN_TRACEFS, no capable() gate), which realistic deployments such as Android/perfetto, ChromeOS and gid=tracing mounts grant to unprivileged tracing users.\nUI:N - The attacker performs both the trigger removal and the event generation itself; no separate victim action is required.\nS:U - The use-after-free corrupts kernel heap memory within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - A concurrent handler dereferences the freed hist_trigger_data (n_keys, fields[], key_size, tracing_map) and the freed enable_trigger_data->file, so reclaimed heap contents are read and can be reflected back through histogram output, giving arbitrary kernel memory disclosure.\nI:H - event_hist_trigger() writes into freed tracing_map elements and event_enable_trigger() writes event-file flags through a pointer read from freed enable_data, so heap spraying the reclaimed objects yields a controlled write primitive suitable for privilege escalation.\nA:H - Use-after-free of hist_data/cmd_ops/enable_data readily causes oops or panic in tracepoint context even without successful exploitation, and the race can be re-triggered at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_hist.c","kernel/trace/trace_events_trigger.c"],"versions":[{"version":"61d445af0a7c70018111919e47beaaee15653f2f","lessThan":"b9c8a1400a3bf633f32820d184f3e05fed0f4af7","status":"affected","versionType":"git"},{"version":"61d445af0a7c70018111919e47beaaee15653f2f","lessThan":"79097812153b826fc156a2930ec8a90ed9edf4a2","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_hist.c","kernel/trace/trace_events_trigger.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b9c8a1400a3bf633f32820d184f3e05fed0f4af7"},{"url":"https://git.kernel.org/stable/c/79097812153b826fc156a2930ec8a90ed9edf4a2"}],"title":"tracing: Fix use-after-free freeing trigger private data","x_generator":{"engine":"bippy-1.2.0"}}}}