{"id":"CVE-2026-99142","kind":"vulnerability","aliases":["CVE-2026-99142"],"related":[],"title":"Linux kernel tracing: operator stack overflow when parsing predicates","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check operator stack capacity before pushing\n\npredicate_parse() uses the first operator stack entry before processing\nany opening parentheses. A push then increments top before writing.\nThe existing check still permits that write when top already points to\nthe last allocated entry, which can access beyond the operator stack.\n\nReject the push when top reaches the last allocated entry.","summary":"The Linux kernel's tracing predicate parser can write one entry past the end of its operator stack when a push happens at capacity. An attacker who can supply a crafted tracing filter may corrupt kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","self-hosted"],"not_affected_if":["tracing-disabled","unprivileged-users-cannot-write-tracing"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel git history (unknown from the sources)\n- Confirm whether tracing is in use with `ls /sys/kernel/tracing` or `ls /sys/kernel/debug/tracing` (unknown from the sources whether this path is exploitable by default)","fix":"- Update to a kernel release that includes the upstream commit 'tracing: Check operator stack capacity before pushing' (exact version unknown from the sources)\n- Reboot into the patched kernel after updating","status":"open","published_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:05+00:00","updated_at":"2026-10-28T11:36:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:36:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes the upstream commit 'tracing: Check operator stack capacity before pushing' (exact version unknown from the sources)\n- Reboot into the patched kernel after updating","reach":"local","title":"Linux kernel tracing: operator stack overflow when parsing predicates","impact":"high","summary":"The Linux kernel's tracing predicate parser can write one entry past the end of its operator stack when a push happens at capacity. An attacker who can supply a crafted tracing filter may corrupt kernel memory.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Kernel memory corruption that could lead to privilege escalation","analyst_note":"Confirm the affected kernel version range and the fixed stable release from the NVD entry or the kernel.org stable commit.","how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel git history (unknown from the sources)\n- Confirm whether tracing is in use with `ls /sys/kernel/tracing` or `ls /sys/kernel/debug/tracing` (unknown from the sources whether this path is exploitable by default)","needs_analyst":true,"not_affected_if":["tracing-disabled","unprivileged-users-cannot-write-tracing"],"who_is_affected":"Systems running a Linux kernel with the ftrace event filter code, which handles predicate expressions written to tracing filter files. Only systems where users or processes can write filter expressions to the tracing interface are realistically exposed. Hosts without tracing filters in use, and those on distribution kernels already carrying the upstream fix, can skip urgent action.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":3344,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-99142':12A,15A 'access':114C 'alloc':110C,127C 'alreadi':105C 'attack':47B 'beyond':115C 'capac':45B,73C 'check':70C,98C 'corrupt':56B 'craft':52B 'cve':10A,13A 'end':35B 'entri':32B,83C,111C,128C 'exist':97C 'filter':54B 'first':80C 'follow':64C 'happen':43B 'host':21B 'increment':92C 'infrastructur':16B 'kernel':2A,17B,24B,57B,62C 'last':109C,126C 'linux':1A,18B,23B,61C 'may':55B 'memori':58B 'one':31B 'open':87C 'oper':4A,38B,71C,81C,117C 'overflow':6A 'parenthes':88C 'pars':8A,77C 'parser':28B 'past':33B 'permit':100C 'point':106C 'predic':9A,27B,76C 'process':85C 'push':42B,75C,90C,121C 'reach':124C 'reject':119C 'resolv':68C 'self':20B 'self-host':19B 'stack':5A,39B,72C,82C,118C 'still':99C 'suppli':50B 'top':93C,104C,123C 'trace':3A,26B,53B,69C 'use':78C 'vulner':65C 'write':30B,95C,102C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ftrace event filter code, which handles predicate expressions written to tracing filter files. Only systems where users or processes can write filter expressions to the tracing interface are realistically exposed. Hosts without tracing filters in use, and those on distribution kernels already carrying the upstream fix, can skip urgent action.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99142","severity":null,"published_at":"2026-10-28T11:17:34+00:00","modified_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}