{"id":"CVE-2026-68283","state":"PUBLISHED","title":"tracing: Fix use-after-free freeing trigger private data","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free freeing trigger private data\n\nCommit 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing\nevent_trigger_data\") moved the kfree() of event_trigger_data to a kthread\nthat runs tracepoint_synchronize_unregister() before freeing. That removed\nthe synchronization the trigger .free callbacks used to get implicitly and\ninline from trigger_data_free().\n\nevent_hist_trigger_free(), event_hist_trigger_named_free() and\nevent_enable_trigger_free() free their satellite data (hist_data, cmd_ops,\nenable_data) right after trigger_data_free() returns. With the\nsynchronization now deferred to the kthread, a concurrent tracepoint\nhandler can still reach that data through the list_del_rcu()'d trigger,\ncausing a use-after-free.\n\nThe histogram teardown must stay synchronous: remove_hist_vars() and\nunregister_field_var_hists() have to detach a synthetic event from the\nhistogram before the trigger-removal write returns, otherwise a following\ncommand races in and the synthetic-event removal fails with -EBUSY, as the\ntrigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait\nwith the correct barrier - tracepoint_synchronize_unregister(), matching\nthe free kthread - before freeing.\n\nThe enable trigger has no such synchronous requirement, and a blocking\nsynchronize there would re-serialize the path that commit deliberately\ndeferred. Give it an optional private_data_free() callback that the free\nkthread runs after its grace period, and free enable_data from there.","publishedAt":"2026-08-10T12:02:15.088Z","updatedAt":"2026-08-17T05:02:18.147Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"b9c8a1400a3bf633f32820d184f3e05fed0f4af7","versionType":"git"},{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"79097812153b826fc156a2930ec8a90ed9edf4a2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_hist.c","kernel/trace/trace_events_trigger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_hist.c","kernel/trace/trace_events_trigger.c"]}],"references":["https://git.kernel.org/stable/c/b9c8a1400a3bf633f32820d184f3e05fed0f4af7","https://git.kernel.org/stable/c/79097812153b826fc156a2930ec8a90ed9edf4a2"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68283.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68283","state":"PUBLISHED","datePublished":"2026-08-10T12:02:15.088Z","dateUpdated":"2026-08-17T05:02:18.147Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.379Z"},"containers":{"cna":{"title":"tracing: Fix use-after-free freeing trigger private data","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix use-after-free freeing trigger private data\n\nCommit 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing\nevent_trigger_data\") moved the kfree() of event_trigger_data to a kthread\nthat runs tracepoint_synchronize_unregister() before freeing. That removed\nthe synchronization the trigger .free callbacks used to get implicitly and\ninline from trigger_data_free().\n\nevent_hist_trigger_free(), event_hist_trigger_named_free() and\nevent_enable_trigger_free() free their satellite data (hist_data, cmd_ops,\nenable_data) right after trigger_data_free() returns. With the\nsynchronization now deferred to the kthread, a concurrent tracepoint\nhandler can still reach that data through the list_del_rcu()'d trigger,\ncausing a use-after-free.\n\nThe histogram teardown must stay synchronous: remove_hist_vars() and\nunregister_field_var_hists() have to detach a synthetic event from the\nhistogram before the trigger-removal write returns, otherwise a following\ncommand races in and the synthetic-event removal fails with -EBUSY, as the\ntrigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait\nwith the correct barrier - tracepoint_synchronize_unregister(), matching\nthe free kthread - before freeing.\n\nThe enable trigger has no such synchronous requirement, and a blocking\nsynchronize there would re-serialize the path that commit deliberately\ndeferred. Give it an optional private_data_free() callback that the free\nkthread runs after its grace period, and free enable_data from there."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"b9c8a1400a3bf633f32820d184f3e05fed0f4af7","versionType":"git"},{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"79097812153b826fc156a2930ec8a90ed9edf4a2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_hist.c","kernel/trace/trace_events_trigger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace.h","kernel/trace/trace_events_hist.c","kernel/trace/trace_events_trigger.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b9c8a1400a3bf633f32820d184f3e05fed0f4af7"},{"url":"https://git.kernel.org/stable/c/79097812153b826fc156a2930ec8a90ed9edf4a2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - Placeholder.\nAC:L - The attacker controls both sides of the race: one thread writes '!hist:'/'!enable_event:' to remove the trigger while another continuously fires the traced event, so an in-flight event_triggers_call() reader reliably touches hist_data/enable_data after they are freed inline.\nPR:L - Registering and removing triggers only needs write access to tracefs (TRACE_MODE_WRITE, DAC plus LOCKDOWN_TRACEFS, no capable() gate), which realistic deployments such as Android/perfetto, ChromeOS and gid=tracing mounts grant to unprivileged tracing users.\nUI:N - The attacker performs both the trigger removal and the event generation itself; no separate victim action is required.\nS:U - The use-after-free corrupts kernel heap memory within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - A concurrent handler dereferences the freed hist_trigger_data (n_keys, fields[], key_size, tracing_map) and the freed enable_trigger_data->file, so reclaimed heap contents are read and can be reflected back through histogram output, giving arbitrary kernel memory disclosure.\nI:H - event_hist_trigger() writes into freed tracing_map elements and event_enable_trigger() writes event-file flags through a pointer read from freed enable_data, so heap spraying the reclaimed objects yields a controlled write primitive suitable for privilege escalation.\nA:H - Use-after-free of hist_data/cmd_ops/enable_data readily causes oops or panic in tracepoint context even without successful exploitation, and the race can be re-triggered at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:02:18.147Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}