Junglewise Threat Intelligence

CVE-2026-23309: Linux Kernel NULL pointer dereference in trigger_data_free

CVE-2026-23309 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's tracing component could allow a local user to crash the system. The issue occurs when the system fails to properly handle memory allocation errors during the setup of event triggers. This results in a system crash (NULL pointer dereference), potentially leading to a denial-of-service condition that disrupts operations.

Technical details

A NULL pointer dereference exists in kernel/trace/trace_events_trigger.c within the trigger_data_free() function. When trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() incorrectly proceeds to an error path that calls trigger_data_free() without a NULL check. The function then attempts to evaluate data->cmd_ops->set_filter, leading to a kernel panic. This is a local vulnerability requiring low privileges to trigger via the tracing interface. Patches have been released across multiple stable kernel branches to add the necessary NULL pointer validation.

Affected products

  • Linux Linux Kernel 6.1.165 to 6.1.167, 6.6.128 to 6.6.130, 6.12.75 to 6.12.77, 6.18.14 to 6.18.17, 6.19.4 to 6.19.7, 7.0-rc1, 7.0-rc2

Timeline

  • 2026-03-05: other: Vulnerability identified by AI code review agent
  • 2026-03-25: disclosed: Initial disclosure and patch commit
  • 2026-03-25: advisory
  • 2026-05-28: other: NVD analysis and enrichment

References

Related threats