tracing: Reject incomplete event filter expressions

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99236
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-11-02 16:17:49 UTC
Updated2026-11-03 20:18:29 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001210000 probability, percentile 0.018830000 (date 2026-11-03)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 4a1a6d35359991c5d47f4bf101cfbe1475c94093 git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 2a98f5d4913ec081e08e1075512cb7ec313d9f72 git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 15ff3cc7f2beecc3f95d66358f20ad7b057466aa git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 b205ff58e02922ac324f931cf9eb238a3acdb048 git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 5a999b5a16530898f0dbe5f8c50fd45ea72e110b git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 1008e9e0b8280d47f1ab5e9c113f666a023a9697 git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 64993d970dde2a2da353e9e99595a4fa88ec27d9 git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46 git Not specified
CNA Linux Linux affected 80765597bc587feae8dbc8ce97a0f32e12a6e625 1fdc4164e488916402badddbb1f51e9380dabb91 git Not specified
CNA Linux Linux affected 4.17 Not specified
CNA Linux Linux unaffected 4.17 semver Not specified
CNA Linux Linux unaffected 5.10.273 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.224 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.60 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.14 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3.1 7.3.* semver Not specified
CNA Linux Linux unaffected 7.4-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report