Executive brief
The Linux kernel's tracing system has a memory safety bug in histogram trigger functionality. An attacker with local access to the tracing system can trigger a use-after-free condition by removing histogram triggers that have referenced variables, potentially leading to denial of service or local privilege escalation.
Technical details
This is a use-after-free vulnerability (CWE-416) in the Linux kernel's tracing histogram subsystem, specifically in the resolve_var_refs() function. The bug occurs when histogram triggers with referenced variables (but no direct variable fields) are removed. The code fails to properly track and protect these referenced variables, allowing them to be freed while still being referenced. An unprivileged local user with access to /sys/kernel/tracing can trigger the vulnerability through a sequence of synthetic event and histogram trigger operations, causing a KASAN (Kernel Address Sanitizer) slab-use-after-free detection and kernel crash. The fix adds proper accounting of referenced variables to the hist_vars structure to prevent premature deallocation.
Affected products
- Linux Linux Kernel 6.5.0-rc1 and earlier versions with tracing histogram support
Timeline
- 2025-10-04: disclosed
- patched: Fix included in kernel patch adding referenced variables to hist_vars tracking