Executive brief
A vulnerability was identified in the Linux kernel's tracing subsystem that could allow an unauthorized user to read memory outside of intended boundaries. This component is used by system administrators and developers to monitor system performance and debug issues. An exploit could potentially lead to the exposure of sensitive system information or cause a system crash, impacting the confidentiality and stability of the operating system.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's tracing subsystem due to improper handling of non-NUL-terminated string fields in `regex_match_glob()`. While most filter predicate functions in the tracing subsystem are length-aware, `regex_match_glob()` previously relied on `glob_match()`, which continues scanning until a NUL byte is encountered. In cases where tracepoint fields (such as those in the xfs namespace) are copied without a trailing NUL, this leads to a slab-out-of-bounds read. The issue is resolved by introducing `glob_match_len()`, a length-bounded version of the matching function, and updating the tracing filter to use it. This vulnerability is reachable via the `xfs_lookup` tracepoint and other similar event fields.
Affected products
- Linux Linux 60f1d5e3bac4 to 265f3a690f6c7d69ef7d2ca50b04b4853a211df3
Timeline
- 2026-07-01: other: Vulnerability fixed in kernel source
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17
- https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3
- https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226
- https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf
- https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15
- https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6
- https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086