Linux kernel tracing accepts incomplete event filter expressions
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
The Linux kernel tracing event filter parser accepts non-empty filter expressions that end with a logical operator, such as a trailing &&, leaving operator state unresolved. A local user with low privileges can trigger out-of-bounds memory access through this path, which can affect confidentiality, integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 4.17 and later | 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1, 7.4-rc1 | Patch available | CNA |
- Linux VendorLinux Affected 4.17 and later Fixed in 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1, 7.4-rc1 Patch available CNA
Remediation
Update to a fixed Linux kernel release: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1 or 7.4-rc1. Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 and Red Hat OpenShift Container Platform 4 and 5 as affected, with no plan available for a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Linux (Linux) Fixed in 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1, 7.4-rc1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-11-02 Threatist record created from CVE-2026-99236
- 2026-11-02 Alias added: GHSA-45x7-jj5h-2j9x
- 2026-11-03 Fix available: Linux/Linux@1fdc4164e488916402badddbb1f51e9380dabb91, Linux/[email protected] · CNA
- 2026-11-03 1 new reference · CNA
- 2026-11-04 Priority changed: MEDIUM → LOW
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
References
Other 9
- https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093
- https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72
- https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa
- https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048
- https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b
- https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697
- https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9
- https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46
- https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-99236 · CVE Program
- CVE-2026-99236 · NVD
- FIRST EPSS
- GHSA-45x7-jj5h-2j9x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-99236 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences