EUVD-2026-115280

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...

CVE-2026-99235 tracing: Save the event file instead of the compatible histogram

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

CVE-2026-99234 tracing: Unregister field variable histograms when the command fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

CVE-2026-99236

The Linux kernel contains a vulnerability in the tracing subsystem where incomplete event filter expressions are not properly rejected. Specifically, if an input ends after an operator (e.g., &&) or a unary ! token, the predicate_parse() function's outer loop falls through with an unresolved oper...

EUVD-2026-115276

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

CVE-2026-99235 tracing: Save the event file instead of the compatible histogram

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

EUVD-2026-115277

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

CVE-2026-99235

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue stems from the create_field_var_hist() function, which incorrectly saves a pointer to an existing histogram (via find_compatible_hist()) rather than the newly created one. Because find_compatible_hist() ma...

CVE-2026-99234

The Linux kernel contains a vulnerability in the tracing subsystem where field variable histograms may remain active if a command fails during processing. Specifically, if create_actions() returns an error, event_hist_trigger_parse() jumps to out_free, which calls destroy_field_var_hists() but fa...

EUVD-2026-115278

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99236 tracing: Reject incomplete event filter expressions

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99236 tracing: Reject incomplete event filter expressions

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99234 tracing: Unregister field variable histograms when the command fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

CVE-2026-99233

The Linux kernel is affected by a vulnerability in the tracing/histograms component. Specifically, the event_hist_trigger_parse() and hist_unreg_all() functions incorrectly use find_synth_event() to look up synthetic events based solely on the event basename. This allows registering or removing a...

EUVD-2026-115275

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99233 tracing/histograms: Verify event_call identity when updating synth_event refcount

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99233 tracing/histograms: Verify event_call identity when updating synth_event refcount

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99232

The Linux kernel contains a vulnerability in the tracing/syscalls component where the function syscall_copy_user_array() uses __copy_from_user() to copy buffer arguments for faultable syscalls (such as write and pwrite64 ). Because __copy_from_user() skips the access_ok() check, it fails to prope...

EUVD-2026-115274

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...

CVE-2026-99231 io_uring/waitid: own the request before clearing ->head

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...