CVE-2026-68283

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free freeing trigger private data

Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing

event_trigger_data") moved the kfree() of event_trigger_data to a kthread

that runs tracepoint_synchronize_unregister() before freeing. That removed

the synchronization the trigger .free callbacks used to get implicitly and

inline from trigger_data_free().

event_hist_trigger_free(), event_hist_trigger_named_free() and

event_enable_trigger_free() free their satellite data (hist_data, cmd_ops,

enable_data) right after trigger_data_free() returns. With the

synchronization now deferred to the kthread, a concurrent tracepoint

handler can still reach that data through the list_del_rcu()'d trigger,

causing a use-after-free.

The histogram teardown must stay synchronous: remove_hist_vars() and

unregister_field_var_hists() have to detach a synthetic event from the

histogram before the trigger-removal

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References