EUVD-2026-115278
GHSA-45x7-jj5h-2j9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local perf-capable account
-
DeliveryOpen self-targeted perf tracepoint event
-
ExploitSet filter ending in trailing logical operator
-
ExecutionTrigger out-of-bounds prog[-1] access
-
ImpactKernel memory disclosure or corruption
Vulnerability Assessment
| Exploitation Conditions | Requires local access with permission to create a perf_event tracepoint (counting) event - in practice governed by kernel.perf_event_paranoid and/or CAP_PERFMON/CAP_SYS_ADMIN - and the ability to issue the PERF_EVENT_IOC_SET_FILTER ioctl with an attacker-crafted filter expression that ends after a logical operator (optionally followed by unary '!' tokens), such as 'common_pid 1 || common_pid 2 &&'. Limiting factors: there is no remote vector (AV:L), the attacker must already hold a local account able to open perf tracepoint events, and the dangerous out-of-bounds copy into a branch target is contingent on adjacent slab contents per the description, which constrains reliable memory corruption on patched/hardened configurations. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-privilege, no-user-interaction flaw with high confidentiality, integrity and availability impact - consistent with a kernel out-of-bounds access that can both leak and corrupt kernel memory. No EPSS score, no CISA KEV entry, and no PoC/exploit reference were supplied: all eight references are kernel.org stable-tree fix commits, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' which aligns with a genuinely exploitable local kernel bug that is not under active exploitation. Net: this is a real, patch-worthy local kernel issue rather than a remote emergency - the local-only vector (AV:L) and the requirement to create a perf tracepoint event meaningfully cap real-world blast radius, and the absence of KEV/EPSS/PoC signals suggests no widespread exploitation at this time. The 'Buffer Overflow' tag should be read loosely: the description is an out-of-bounds read of prog[-1] that can additionally copy an out-of-bounds word into a branch target, i.e. an adjacent-slab memory-safety flaw rather than a classic linear buffer overflow. |
| Exploit ScenarioDerived | A local user who is permitted to create perf tracepoint events opens a self-targeted counting event and issues PERF_EVENT_IOC_SET_FILTER with a filter string that ends in a trailing logical operator (e.g. 'common_pid 1 || common_pid 2 &&'). The unresolved operator state leaves prog[0].target at -1, so the second parse pass reads prog[-1] out of bounds and, depending on adjacent slab contents, may copy an out-of-bounds word into a branch target that still passes the forward-only check. No public exploit code or PoC reference is provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Out-of-bounds read and possible out-of-bounds write in the Linux kernel tracing event-filter parser: a local user able to create a perf tracepoint counting event and issue PERF_EVENT_IOC_SET_FILTER with an expression that ends after a logical operator (optionally followed by unary '!' tokens, e.g. 'common_pid 1 || common_pid 2 &&') leaves unresolved operator state, so the second parsing pass reads prog[-1] and, depending on adjacent slab contents, can copy an out-of-bounds word into a branch target that survives the forward-only jump check. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) matches an unprivileged local attacker gaining high confidentiality, integrity and availability impact through kernel memory access, but exploitation requires local access plus permission to open perf tracepoint events, in practice governed by kernel.perf_event_paranoid and/or CAP_PERFMON/CAP_SYS_ADMIN. No public exploit code and no CISA KEV entry were identified at time of analysis, and reliable memory corruption is contingent on adjacent slab contents; upstream stable fix commits are available.
RemediationAI
Apply the upstream stable fix, which rejects the outer-loop fallthrough whenever a predicate has already been parsed so that non-empty expressions only reach finalization after their operators are resolved; the eight stable backports listed in the references (starting at https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093 through https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46) cover the maintained branches, and the specific released kernel versions that carry them are not stated in the supplied data, so verify against your distribution's kernel advisory. Until the patched kernel is running, block the reachable path by restricting creation of perf tracepoint events for untrusted local users - raising kernel.perf_event_paranoid or withholding CAP_PERFMON/CAP_SYS_ADMIN - at the cost of disabling perf-based profiling and tracing for those users. Note that the trigger requires the ability to open a perf tracepoint counting event and issue PERF_EVENT_IOC_SET_FILTER with a crafted filter string, so the perf access restriction only reduces exposure where unprivileged perf use is not required; updating to a kernel containing the fix is the complete remedy because the parser itself must reject incomplete expressions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the kernel tracing event filter compiler (predicate_parse() and the second-pass jump resolution in kernel/trace/trace_events_filter.c), the code that turns a user-supplied filter string attached to a tracepoint event into an array of filter_pred records, where each record's target field encodes a branch destination for logical operators. Predicate parsing is two-phase: an inner loop handles a non-empty expression and resolves pending logical operators before finalization, while the outer loop is meant to reject malformed trailing input. When the string ends immediately after an operator, the outer loop falls through without resolving the operator state, leaving prog[0].target at the -1 sentinel; the second pass then indexes prog[-1] before the forward-jump validation can reject it, and depending on adjacent slab contents the out-of-bounds word read can be propagated into a branch target that satisfies the forward-only check. The vulnerable interface is exposed through perf: a self-targeted perf tracepoint counting event can reach the parser via the PERF_EVENT_IOC_SET_FILTER ioctl, meaning the attacker needs the ability to create such an event (perf_event_paranoid, CAP_PERFMON or CAP_SYS_ADMIN) and to supply the crafted filter string. The CWE field is not populated in the supplied data; the practical class is an out-of-bounds read with a conditional out-of-bounds write (buffer overflow) in kernel memory, per the provided tags. CPE data is generic (cpe:2.3:a:linux:linux), so the affected scope is the upstream kernel branches carrying the flawed parser rather than a specific distribution build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only trigger via perf ioctl (AV:L); needs permission to create a tracepoint event, so PR:L not PR:N; deterministic out-of-bounds read gives AC:L, with kernel memory read/corrupt justifying C/I/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
2DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tracing: Reject incomplete event filter expressions
A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state.
For example, "common_pid 1 || common_pid 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.
Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.
Articles & Coverage 1
Executive ViewAI
A high-severity vulnerability in the Linux kernel tracing subsystem (CVE-2026-99236) enables a local user with perf event access to potentially read or write out-of-bounds kernel memory, compromising confidentiality, integrity, and availability. Affected systems include any Linux environment where unprivileged users can create perf tracepoints, such as development workstations or container hosts. Leadership should prioritize patching because exploitation could lead to system compromise or data leakage, though no active exploits have been observed yet.
No vendor-released patch identified at time of analysis. Interim mitigations: set kernel.perf_event_paranoid to 2 or higher to restrict unprivileged perf event access; limit CAP_PERFMON/CAP_SYS_ADMIN to trusted users; consider disabling perf events system-wide (kernel.perf_event_paranoid=-1 or via kernel.perf_event_mlock_kb) if not required.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB