CVE-2026-23088

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix crash on synthetic stacktrace field usage

When creating a synthetic event based on an existing synthetic event that

had a stacktrace field and the new synthetic event used that field a

kernel crash occurred:

~# cd /sys/kernel/tracing

~# echo 's:stack unsigned long stack[];' > dynamic_events

~# echo 'hist:keys=prev_pid:s0=common_stacktrace if prev_state & 3' >> events/sched/sched_switch/trigger

~# echo 'hist:keys=next_pid:s1=$s0:onmatch(sched.sched_switch).trace(stack,$s1)' >> events/sched/sched_switch/trigger

The above creates a synthetic event that takes a stacktrace when a task

schedules out in a non-running state and passes that stacktrace to the

sched_switch event when that task schedules back in. It triggers the

"stack" synthetic event that has a stacktrace as its field (called "stack").

~# echo 's:syscall_stack s64 id; unsigned long stack[];' >> dynamic_events

~# echo 'hist:keys=common_pid

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References