PT-2026-6158 · Linux+1 · Linux Kernel+1

Published 2026-01-01 · Updated 2026-05-22 · CVE-2026-23088

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.3+deb14-amd64 #1

Description A flaw exists in the Linux kernel related to the handling of synthetic stacktraces within the tracing subsystem. Specifically, when creating a synthetic event based on an existing event with a stacktrace field, and subsequently using that field in a new synthetic event, a kernel crash can occur. This is due to the stacktrace field not being correctly identified as a dynamic event, leading to it being treated as a normal field during data retrieval. The issue arises when enabling the affected event or using it in a histogram. The root cause is that the metadata is retrieved instead of a dynamic array.

Recommendations Update to Linux kernel version 6.16.3+deb14-amd64 #1 or later to address this issue.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-23088

ECHO-40C1-1118-0D1F

OPENSUSE-SU-2026:20416-1

SUSE-SU-2026:0962-1

SUSE-SU-2026:1081-1

SUSE-SU-2026:20838-1

SUSE-SU-2026:20931-1

SUSE-SU-2026:21114-1

SUSE-SU-2026:21123-1

SUSE-SU-2026:21255-1

SUSE-SU-2026:21284-1

USN-8278-1

USN-8289-1

USN-8296-1

Affected Products

Linux Kernel

Ubuntu

References · 772

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23088.json · Exploit
• https://ubuntu.com/security/CVE-2026-23020 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23083 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23093 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21114-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31504 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-23088 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23148 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22991 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23131 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23256 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23123 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71186 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40149 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8278-1 · Vendor Advisory