CVE-2026-99235 tracing: Save the event file instead of the compatible histogram

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

EUVD-2026-115277

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

CVE-2026-99235

A slab-use-after-free vulnerability exists in the Linux kernel tracing subsystem. The issue stems from the create_field_var_hist() function, which incorrectly saves a pointer to an existing histogram (via find_compatible_hist()) rather than the newly created one. Because find_compatible_hist() ma...

CVE-2026-99234

The Linux kernel contains a vulnerability in the tracing subsystem where field variable histograms may remain active if a command fails during processing. Specifically, if create_actions() returns an error, event_hist_trigger_parse() jumps to out_free, which calls destroy_field_var_hists() but fa...

EUVD-2026-115278

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99236 tracing: Reject incomplete event filter expressions

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99236 tracing: Reject incomplete event filter expressions

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99234 tracing: Unregister field variable histograms when the command fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

CVE-2026-99233

The Linux kernel is affected by a vulnerability in the tracing/histograms component. Specifically, the event_hist_trigger_parse() and hist_unreg_all() functions incorrectly use find_synth_event() to look up synthetic events based solely on the event basename. This allows registering or removing a...

EUVD-2026-115275

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99233 tracing/histograms: Verify event_call identity when updating synth_event refcount

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99233 tracing/histograms: Verify event_call identity when updating synth_event refcount

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99232

The Linux kernel contains a vulnerability in the tracing/syscalls component where the function syscall_copy_user_array() uses __copy_from_user() to copy buffer arguments for faultable syscalls (such as write and pwrite64 ). Because __copy_from_user() skips the access_ok() check, it fails to prope...

EUVD-2026-115274

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...

CVE-2026-99231 io_uring/waitid: own the request before clearing ->head

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99231

The Linux kernel contains a vulnerability in the io_uring subsystem related to waitid. The root cause is that io_waitid_wait() clears the ->head pointer before attempting to own the request by incrementing ->refs. This creates a race condition where another process might complete the reques...

EUVD-2026-115273

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99231 io_uring/waitid: own the request before clearing ->head

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99230 io_uring/cmd: don't leave list poison in ->hash_node

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

CVE-2026-99230

The Linux kernel contains a vulnerability where the io_uring_cmd_del_cancelable() function uses hlist_del() to remove a command from ->cancelable_uring_cmd, leaving LIST_POISON1/2 behind in the ->hash_node. Because requests are recycled through a request cache without being reinitialised, s...