Refcount Vulnerability in Linux Kernel Affecting Synthetic Events

CVE-2026-99233

What is CVE-2026-99233?

A vulnerability in the Linux kernel allows for incorrect adjustments in reference counts for synthetic events during histogram registration and unregistration. When histograms are registered or removed, if the event basename matches incorrectly, it can lead to a synthetic event being freed while its active histogram action still holds a reference. This can cause potential application crashes or unexpected behavior. To address the issue, a new function, find_synth_event_call(), has been introduced to accurately validate event identities prior to modifying reference counts.

References