{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-64299", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.778Z", "datePublished": "2026-07-25T08:49:35.742Z", "dateUpdated": "2026-10-19T20:38:22.703Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:52:57.094Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attacker installs a glob filter through tracefs or perf_event_open and triggers it using a local pathname syscall on an affected filesystem such as XFS. Network clients cannot normally install or observe the required tracing filter.\nAC:L - No race or uncontrollable timing is required; the attacker selects a full-glob pattern and triggers a non-NUL-terminated event field repeatedly. Reused per-CPU trace buffers can also be groomed by attacker-controlled events.\nPR:L - Although user namespaces alone cannot bypass tracefs or initial-namespace perf capability checks, ordinary users can install filters when tracefs access is delegated to a tracing group or perf_event_paranoid permits kernel events. These are supported and reasonable deployments requiring only basic user privileges.\nUI:N - The attacker can install the filter and trigger pathname lookups directly without another user's action.\nS:U - The out-of-bounds read affects the host kernel within the same security authority and does not cross a guest-host, hypervisor, or IOMMU boundary.\nC:H - glob_match() ignores the supplied field length and scans until an incidental NUL, allowing filter results to act as an oracle over adjacent or reused kernel trace-buffer data. The read is not strictly bounded to a few bytes.\nI:N - The vulnerable code only reads memory and changes the Boolean filter result; it provides no out-of-bounds write or other memory-modification primitive.\nA:H - The repeatable unbounded scan can cross the event allocation or page boundary, producing the reported KASAN invalid access and potentially an oops or panic on inaccessible or poisoned memory. Panic-on-warning configurations make total availability loss directly achievable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/glob.h", "kernel/trace/trace_events_filter.c", "lib/glob.c" ], "versions": [ { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "265f3a690f6c7d69ef7d2ca50b04b4853a211df3", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "ee5b8888d3248618251fb69a2fad92afcb81557e", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "56d4c9ab84714eebb285a2fee68aaedf81e3ef15", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "35ae19764eabfe9c29029d3b5713c86e6855acdf", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "ebb55902856973906c8bb339a3a34824ed4a5086", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "2dad64a97e1df47f5d9ccb17fa319aa348617226", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "e5d5f3bd053a5f14787526c9f0f55ef900d43ac6", "status": "affected", "versionType": "git" }, { "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "0a6070839b1ef276d5b05bedfb787743e140fb17", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/glob.h", "kernel/trace/trace_events_filter.c", "lib/glob.c" ], "versions": [ { "version": "4.10", "status": "affected" }, { "version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.261" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.212" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.96" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.39" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.1.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3" }, { "url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e" }, { "url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15" }, { "url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf" }, { "url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086" }, { "url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226" }, { "url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6" }, { "url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17" } ], "title": "tracing: Prevent out-of-bounds read in glob matching", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2026-64299", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2026-10-16T15:38:40.585671Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:38:22.703Z" } } ] } }