What is the CVSS score of CVE-2026-64299?

CVE-2026-64299 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64299?

The Linux kernel tracing subsystem contains an out-of-bounds memory read vulnerability (CVE-2026-64299) that allows local attackers with access to trace event filters to leak sensitive kernel memory…. A patch is available.

How to fix or mitigate CVE-2026-64299?

Within 24 hours, inventory all Linux systems with kernel tracing interfaces and determine which allow unprivileged user access; prioritize systems in multi-tenant or shared-use environments. Within 7 days, obtain the available vendor-released patch from your Linux distribution provider and validate it in a test environment matching your production configuration. Within 30 days, deploy the patched kernel across all affected systems according to your standard change management procedures, rebooting as required and monitoring for any regressions.

Linux Kernel CVE-2026-64299

EUVD-2026-49011 HIGH

Out-of-bounds Read (CWE-125)

2026-07-25 Linux

GHSA-fv73-wvqp-hjm7

Buffer Overflow Information Disclosure Linux

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Local access to debugfs with low-privilege capability required; read-only OOB gives slab memory disclosure (C:H) and potential kernel panic (A:H); no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:33 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.1 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tracing: Prevent out-of-bounds read in glob matching

String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it.

regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint.

Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.

AnalysisAI

Out-of-bounds slab read in the Linux kernel tracing subsystem allows a local attacker with access to the trace event filter interface to leak kernel slab memory or crash the kernel. The flaw exists because regex_match_glob() ignores the bounded length passed by filter predicate functions and calls the NUL-terminated-string-only glob_match(), which scans past the end of non-NUL-terminated dynamic string fields - exemplified by XFS namespace tracepoints whose dynamic char arrays are copied without a trailing NUL. EPSS is 0.22% (13th percentile); no public exploit code exists and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability is in the Linux kernel's ftrace/trace-event filter subsystem (lib/glob.c and kernel/trace/trace_events_filter.c). When a glob-style filter expression is applied to a trace event string field, the predicate functions (filter_pred_string(), filter_pred_strloc(), filter_pred_strrelloc()) correctly pass a bounded field length to regex match callbacks. Every matcher except regex_match_glob() honours this length. regex_match_glob() ignores the length argument and delegates to glob_match(), which is designed exclusively for NUL-terminated C strings and scans until it finds a zero byte. Dynamic char array fields in XFS namespace tracepoints (e.g., xfs_lookup) are populated via __get_str() / __assign_str() without appending a NUL, so glob_match() reads past the field boundary into adjacent slab allocations. The root cause class is CWE-125 (Out-of-bounds Read). The fix introduces glob_match_len() with explicit length bounds, shared via a factored inner helper so glob_match() retains its existing NUL-scan semantics. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from kernel 4.10 onward.

RemediationAI

Upgrade the Linux kernel to one of the patched stable releases: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc3 per the upstream commits at git.kernel.org. Ubuntu users should apply USN-8726-1 or USN-8727-1 available at https://ubuntu.com/security/notices/USN-8726-1 and https://ubuntu.com/security/notices/USN-8727-1. Prior to patching, restrict access to the debugfs tracing interface: ensure /sys/kernel/debug/tracing is mount-restricted (e.g., mount -o remount,mode=700 /sys/kernel/debug) so only privileged administrators can write trace filters - the trade-off is loss of unprivileged tracing tools. Alternatively, disable XFS tracepoints specifically with echo 0 > /sys/kernel/debug/tracing/events/xfs/enable to eliminate the primary documented trigger path without impacting filesystem operation. Removing CAP_SYS_ADMIN from untrusted container workloads also eliminates the attack surface at a broader level.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64299 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64299

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code