Live › vulnerability › CVE-2026-99142
Go to dashboardThe Linux kernel's tracing predicate parser can write one entry past the end of its operator stack when a push happens at capacity. An attacker who can supply a crafted tracing filter may corrupt kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the ftrace event filter code, which handles predicate expressions written to tracing filter files. Only systems where users or processes can write filter expressions to the tracing interface are realistically exposed. Hosts without tracing filters in use, and those on distribution kernels already carrying the upstream fix, can skip urgent action.
No product ranges from the sources yet.
uname -r and compare it to the fixed release in the kernel git history (unknown from the sources)ls /sys/kernel/tracing or ls /sys/kernel/debug/tracing (unknown from the sources whether this path is exploitable by default)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tracing: Check operator stack capacity before pushing
predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that write when top already points to the last allocated entry, which can access beyond the operator stack.
Reject the push when top reaches the last allocated entry.
This page as .md · .json · in your agent: get_signal("CVE-2026-99142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.