VulnerabilityPublished 2 Nov 2026

CVE-2026-99234: Linux kernel · tracing: Unregister field variable histograms when the command fails

Source GCVE Database

Compare

Authoritative record:CVE-2026-99234· Low

Not known to be exploited · fixed in f21351d1c4cdcc6a68f03636a407c2af1a5e1e10 : update Linux kernel when convenient.

Data as of 2 Nov 2026, 19:29 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f21351d1c4cdcc6a68f03636a407c2af1a5e1e10, dba0f492703956801149cc70b39d2650a37995c3, d0090baf02dd08f6e909f36f0ad54a4e80f5e79b +5

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-593w-c428-4hpw

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 02205a6752f223779a1b0e9e8ffacbea6e717851, < f21351d1c4cdcc6a68f03636a407c2af1a5e1e10	Fixed in f21351d1c4cdcc6a68f03636a407c2af1a5e1e10
LinuxLinux	Affected ≥ 02205a6752f223779a1b0e9e8ffacbea6e717851, < dba0f492703956801149cc70b39d2650a37995c3	Fixed in dba0f492703956801149cc70b39d2650a37995c3
LinuxLinux	Affected ≥ 02205a6752f223779a1b0e9e8ffacbea6e717851, < d0090baf02dd08f6e909f36f0ad54a4e80f5e79b	Fixed in d0090baf02dd08f6e909f36f0ad54a4e80f5e79b
LinuxLinux	Affected ≥ 02205a6752f223779a1b0e9e8ffacbea6e717851, < aae0ccd7326eef78dcdefffef3d1253e6f0615ca	Fixed in aae0ccd7326eef78dcdefffef3d1253e6f0615ca
LinuxLinux	Affected ≥ 02205a6752f223779a1b0e9e8ffacbea6e717851, < a3d7ffd2409700748a495b645948fef48199206e	Fixed in a3d7ffd2409700748a495b645948fef48199206e
LinuxLinux	Affected ≥ 02205a6752f223779a1b0e9e8ffacbea6e717851, < 431959fc76456cbba539279fe8967aa9391e6f23	Fixed in 431959fc76456cbba539279fe8967aa9391e6f23

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

No explicit vendor advisory or patch links are provided in the input data.

Description

CVE-2026-99234 is a vulnerability in the Linux kernel tracing subsystem where field variable histograms are not properly unregistered when a command fails. This can leave histogram triggers active and counting even after the command has failed, potentially causing resource leaks or inconsistent tracing state.

Impact

The impact is that histogram triggers remain active and counting even after the command that created them fails, which can lead to resource leaks or inconsistent tracing data. There is no indication of direct security compromise such as privilege escalation or denial of service from the provided data. No known exploits in the wild have been reported.

Summary

The vulnerability involves the tracing subsystem in the Linux kernel where create_field_var_hist() registers secondary histogram triggers for fields used as variables in actions. If a later part of the same command fails, the error handling path frees the histogram entries but does not unregister the triggers, leaving them active and untracked. This occurs because unregister_field_var_hists() is only called from event_hist_trigger_free(), not from the error exit path out_free. The fix involves unregistering these field variable histograms in the error path and ensuring triggers are recorded as soon as they are registered to avoid leaving registered triggers untracked.

References

Community reviews

Loading reviews…