Executive brief
A vulnerability was identified in the Linux kernel's event tracing component. An attacker could potentially cause a system crash by providing an excessively long name for a histogram variable, which leads to a null pointer dereference. This affects the stability and availability of the operating system.
Technical details
A vulnerability exists in 'kernel/trace/trace_events_hist.c' within the Linux kernel. The function 'hist_field_name()' can return a NULL pointer when 'snprintf()' truncation occurs during the processing of fully-qualified VAR_REF or EXPR cases. This happens because histogram variable names parsed from trigger strings lack a length cap, unlike 'system' and 'event_name' which are bounded by 'MAX_EVENT_NAME_LEN'. Callers such as 'strcat()' and 'strcmp()' do not expect a NULL return value, leading to a null pointer dereference and subsequent kernel oops/crash. The fix ensures the function returns an empty string instead of NULL upon truncation.
Affected products
- Linux Linux Kernel 6.6.141 to 6.6.142
Timeline
- 2026-07-19: advisory: CVE-2026-64028 published by NVD
- 2026-05-20: patched: Fix committed to mainline kernel by Steven Rostedt
References
- https://git.kernel.org/stable/c/0402a1d3ddec565132867337ed44514a09d84728
- https://git.kernel.org/stable/c/37377b39ff86dacbc533275c1155210d4fd5dc91
- https://git.kernel.org/stable/c/576ec047d20b368b43c4d5db98c4f2e0f3c101ec
- https://git.kernel.org/stable/c/915c1254fe0788abddc31095b360e9dc98907a34
- https://git.kernel.org/stable/c/be4e99038c1603fa6b329d8ee3e364825e17c353
- https://git.kernel.org/stable/c/d6c8b3ebdcdb12b59ad4212acb137cc56cae453d
- https://git.kernel.org/stable/c/e3f5d42cdc2f167719564693675f1eead81378ea