---
id: "CVE-2026-99142"
kind: "vulnerability"
aliases: ["CVE-2026-99142"]
title: "Linux kernel tracing: operator stack overflow when parsing predicates"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "linux", "self-hosted"]
not_affected_if: ["tracing-disabled", "unprivileged-users-cannot-write-tracing"]
published_at: "2026-10-28T11:17:34+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:36:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99142", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel tracing: operator stack overflow when parsing predicates

The Linux kernel's tracing predicate parser can write one entry past the end of its operator stack when a push happens at capacity. An attacker who can supply a crafted tracing filter may corrupt kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel git history (unknown from the sources)
- Confirm whether tracing is in use with `ls /sys/kernel/tracing` or `ls /sys/kernel/debug/tracing` (unknown from the sources whether this path is exploitable by default)

## Fix

- Update to a kernel release that includes the upstream commit 'tracing: Check operator stack capacity before pushing' (exact version unknown from the sources)
- Reboot into the patched kernel after updating

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99142

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check operator stack capacity before pushing

predicate_parse() uses the first operator stack entry before processing
any opening parentheses. A push then increments top before writing.
The existing check still permits that write when top already points to
the last allocated entry, which can access beyond the operator stack.

Reject the push when top reaches the last allocated entry.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_