CVE-2026-99236

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-11-02 16:17:49.003000

Last modified

2026-11-02 16:17:49.003000

View original CVE JSON

{
  "id": "CVE-2026-99236",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-11-02T16:17:49.003",
  "lastModified": "2026-11-02T16:17:49.003",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/trace/trace_events_filter.c",
            "tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "4a1a6d35359991c5d47f4bf101cfbe1475c94093",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "2a98f5d4913ec081e08e1075512cb7ec313d9f72",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "15ff3cc7f2beecc3f95d66358f20ad7b057466aa",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "b205ff58e02922ac324f931cf9eb238a3acdb048",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "5a999b5a16530898f0dbe5f8c50fd45ea72e110b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "1008e9e0b8280d47f1ab5e9c113f666a023a9697",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "64993d970dde2a2da353e9e99595a4fa88ec27d9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625",
              "lessThan": "5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/trace/trace_events_filter.c",
            "tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.17",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.17",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.273",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.224",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.161",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.115",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.60",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.14",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3.1",
              "lessThanOrEqual": "7.3.*",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}