Executive brief
The Linux kernel's tracing subsystem contains a buffer overflow vulnerability in the synthetic field helpers, which build command strings using unsafe string concatenation. Attackers with privileges to configure trace events could provide long field names or filter lists that overflow fixed-size buffers, potentially leading to kernel memory corruption and privilege escalation.
Technical details
This is a classic buffer overflow (CWE-120) in the kernel's trace_events_hist.c module. The vulnerable functions `find_synthetic_field_var()` and `create_field_var_hist()` used raw strcpy/strcat operations to build synthetic variable names and histogram commands in fixed MAX_FILTER_STR_VAL-sized buffers. An attacker who can configure trace events with excessively long field names, key lists, or saved filters can overflow these staging buffers, corrupting kernel memory. The fix replaces unsafe string operations with seq_buf API calls that enforce bounds checking and return -E2BIG on overflow. Local tracing privileges are required to exploit this; it is not network-reachable.
Affected products
- Linux Linux Kernel affected versions prior to fix commit f07883450eb14d1cf020b55d9f3a7ec5683bcd26
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: upstream commit f07883450eb14d1cf020b55d9f3a7ec5683bcd26