CVE-2026-23309 Linux CVE debrief

Who should care

Linux system administrators running affected kernel versions, particularly those using kernel tracing and histogram features; security teams monitoring kernel-level vulnerabilities; organizations with custom kernel builds or delayed patching cycles

Technical summary

The vulnerability exists in kernel/trace/trace_events_hist.c in the trigger_data_free() function. When trigger_data_alloc() fails during histogram trigger parsing, the error path calls trigger_data_free() with a NULL pointer. Unlike kfree(), which safely handles NULL, trigger_data_free() attempts to evaluate data->cmd_ops->set_filter without validation, causing a NULL pointer dereference. The fix adds a simple NULL check at the beginning of trigger_data_free() before any pointer dereferencing occurs. This is a defensive coding issue in error handling paths that requires local access to trigger.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates to patched versions: 6.1.167 or later, 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, 6.19.7 or later, or 7.0-rc3 or later
• Verify kernel version using uname -r and compare against affected version ranges
• If running affected kernel versions and unable to immediately patch, consider restricting access to tracing histogram configuration via appropriate permissions
• Monitor system logs for unexpected crashes in tracing-related operations
• Review custom tracing configurations for potential trigger paths that could exercise the vulnerable code path

Evidence notes

The vulnerability is classified as CWE-476 (NULL Pointer Dereference). The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high availability impact. Affected versions span multiple stable branches: 6.1.165 to 6.1.167 (exclusive), 6.6.128 to 6.6.130 (exclusive), 6.12.75 to 6.12.77 (exclusive), 6.18.14 to 6.18.17 (exclusive), 6.19.4 to 6.19.7 (exclusive), and 7.0-rc1/rc2. Six patch commits are referenced from kernel.org stable repositories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.