CVE-2026-23309
published 2026-03-25CVE-2026-23309: In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
2.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()
jumps to the out_free error path. While kfree() safely handles a NULL
pointer, trigger_data_free() does not. This causes a NULL pointer
dereference in trigger_data_free() when evaluating
data->cmd_ops->set_filter.
Fix the problem by adding a NULL pointer check to trigger_data_free().
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | >= 0550069cc25f513ce1f109c88f7c1f01d63297db < 457965c13f0837a289c9164b842d0860133f6274 | 457965c13f0837a289c9164b842d0860133f6274 |
| linux | linux | >= 335dfe4bc6368e70e8c15419375cf609c4f85558 < 2ce8ece5a78da67834db7728edc801889a64f643 | 2ce8ece5a78da67834db7728edc801889a64f643 |
| linux | linux | >= 6.1.165 < 6.1.167 | 6.1.167 |
| linux | linux | >= 6.12.75 < 6.12.77 | 6.12.77 |
| linux | linux | >= 6.18.14 < 6.18.17 | 6.18.17 |
| linux | linux | >= 6.19.4 < 6.19.7 | 6.19.7 |
| linux | linux | >= 6.6.128 < 6.6.130 | 6.6.130 |
| linux | linux | >= 7e6556e9329bc484e9dcdab6e346d959267c0636 < 59c15b9cc453b74beb9f04c6c398717e73612dc3 | 59c15b9cc453b74beb9f04c6c398717e73612dc3 |
| linux | linux | >= 9b0513905e0598b9f8cfccab8e47497aed5d935d < 42b380f97d65e76e7b310facd525f730272daf57 | 42b380f97d65e76e7b310facd525f730272daf57 |
| linux | linux | >= c10f0efe57728508d796ae4ba7abe4c14ec3d8ef < 13dcd9269e225e4c4ceabdaeebe2ce4661b54c6e | 13dcd9269e225e4c4ceabdaeebe2ce4661b54c6e |
| linux | linux | >= e42efbe9754da78eafe11f6bd3ca9c8a094a752a < 477469223b2b840f436ce204333de87cb17e5d93 | 477469223b2b840f436ce204333de87cb17e5d93 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 0 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.1.165 < 6.1.167 | 6.1.167 |
| linux | linux_kernel | >= 6.12.75 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.18.14 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.4 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.2.0 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.6.128 < 6.6.130 | 6.6.130 |
| linux | linux_kernel | >= 6.7.0 < 6.12.77 | 6.12.77 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0-rc2 tracing trigger_data_free null pointer dereference (Nessus ID 304113 / WID-SEC-2026-0861)
vuldb·2026-06-01·CVSS 5.5
CVE-2026-23309 [MEDIUM] Linux Kernel up to 7.0-rc2 tracing trigger_data_free null pointer dereference (Nessus ID 304113 / WID-SEC-2026-0861)
A vulnerability was found in Linux Kernel up to 7.0-rc2. It has been rated as critical. The affected element is the function trigger_data_free of the component tracing. Performing a manipulation results in null pointer dereference.
This vulnerability was named CVE-2026-23309. The attack needs to be approached within the local network. There is no available exploit.
Upgrading the affected component is advised.
OSV
CVE-2026-23309: In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fai
osv·2026-03-25
CVE-2026-23309 CVE-2026-23309: In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fai
In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handles a NULL pointer, trigger_data_free() does not. This causes a NULL pointer dereference in trigger_data_free() when evaluating data->cmd_ops->set_filter. Fix the problem by adding a NULL pointer check to trigger_data_free(). The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y.
OSV
tracing: Add NULL pointer check to trigger_data_free()
osv·2026-03-25
CVE-2026-23309 tracing: Add NULL pointer check to trigger_data_free()
tracing: Add NULL pointer check to trigger_data_free()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()
jumps to the out_free error path. While kfree() safely handles a NULL
pointer, trigger_data_free() does not. This causes a NULL pointer
dereference in trigger_data_free() when evaluating
data->cmd_ops->set_filter.
Fix the problem by adding a NULL pointer check to trigger_data_free().
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
GHSA
GHSA-f7v6-c4j6-g8wv: In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() f
ghsa_unreviewed·2026-03-25
CVE-2026-23309 GHSA-f7v6-c4j6-g8wv: In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() f
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()
jumps to the out_free error path. While kfree() safely handles a NULL
pointer, trigger_data_free() does not. This causes a NULL pointer
dereference in trigger_data_free() when evaluating
data->cmd_ops->set_filter.
Fix the problem by adding a NULL pointer check to trigger_data_free().
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
Red Hat
kernel: tracing: Add NULL pointer check to trigger_data_free()
vendor_redhat·2026-03-25
CVE-2026-23309 CWE-476 kernel: tracing: Add NULL pointer check to trigger_data_free()
kernel: tracing: Add NULL pointer check to trigger_data_free()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Add NULL pointer check to trigger_data_free()
If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()
jumps to the out_free error path. While kfree() safely handles a NULL
pointer, trigger_data_free() does not. This causes a NULL pointer
dereference in trigger_data_free() when evaluating
data->cmd_ops->set_filter.
Fix the problem by adding a NULL pointer check to trigger_data_free().
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
A flaw was found in the Linux kernel. When the 'trigger_data_alloc()' function fails to allocate memory and returns a null pointe
Debian
CVE-2026-23309: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Ad...
vendor_debian·2026
CVE-2026-23309 [LOW] CVE-2026-23309: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Ad...
In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handles a NULL pointer, trigger_data_free() does not. This causes a NULL pointer dereference in trigger_data_free() when evaluating data->cmd_ops->set_filter. Fix the problem by adding a NULL pointer check to trigger_data_free(). The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.19.8-1)
sid: resolved (fixed in 6.19.8-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/13dcd9269e225e4c4ceabdaeebe2ce4661b54c6ehttps://git.kernel.org/stable/c/2ce8ece5a78da67834db7728edc801889a64f643https://git.kernel.org/stable/c/42b380f97d65e76e7b310facd525f730272daf57https://git.kernel.org/stable/c/457965c13f0837a289c9164b842d0860133f6274https://git.kernel.org/stable/c/477469223b2b840f436ce204333de87cb17e5d93https://git.kernel.org/stable/c/59c15b9cc453b74beb9f04c6c398717e73612dc3
2026-03-25
Published