{"id":"CVE-2026-99143","kind":"vulnerability","aliases":["CVE-2026-99143"],"related":[],"title":"Linux kernel: tracing predicate parser can write past its allocation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Keep the predicate limit separate from program capacity\n\npredicate_parse() adds two to nr_preds to reserve the terminal TRUE\nand FALSE entries. It also uses that increased value as the limit for\nparsed predicates. If the initial count is smaller than the number\nactually parsed, the program can fill the allocation and subsequent\naccesses can go past its end.\n\nKeep nr_preds as the predicate limit and use a separate value for the\nallocation size. This leaves space for both terminal entries and a\nzeroed entry when parsing stops at the limit.","summary":"The Linux kernel tracing subsystem's predicate parser uses an incorrect limit when parsing event filter predicates, so a parse can run past the end of the allocated buffer. The sources do not say what an attacker can do beyond an out-of-bounds access in kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted"],"not_affected_if":[],"how_to_check":"- `uname -r` to see the running kernel version\n- Compare the running kernel against the fixed kernel version in the upstream NVD entry (unknown from these sources)","fix":"- Install the Linux kernel release that contains the upstream fix for CVE-2026-99143 (version unknown from these sources)\n- Reboot into the patched kernel and confirm with `uname -r`","status":"open","published_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:03+00:00","updated_at":"2026-10-28T11:36:03+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:36:03Z","model":"claude-haiku-5-5","output":{"fix":"- Install the Linux kernel release that contains the upstream fix for CVE-2026-99143 (version unknown from these sources)\n- Reboot into the patched kernel and confirm with `uname -r`","reach":"local","title":"Linux kernel: tracing predicate parser can write past its allocation","impact":"medium","summary":"The Linux kernel tracing subsystem's predicate parser uses an incorrect limit when parsing event filter predicates, so a parse can run past the end of the allocated buffer. The sources do not say what an attacker can do beyond an out-of-bounds access in kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; out-of-bounds kernel memory access, impact not stated","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99143 and the upstream kernel commit for affected version ranges, required privileges and the fixed version.","how_to_check":"- `uname -r` to see the running kernel version\n- Compare the running kernel against the fixed kernel version in the upstream NVD entry (unknown from these sources)","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources describe the bug in the kernel's tracing predicate code but do not say which kernel versions, distributions or tracing configurations are affected. Systems with tracing or event filters disabled may not be exposed, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3418,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99143':13A,16A 'access':69B,138C 'actual':128C 'add':94C 'alloc':10A,51B,135C,158C 'also':108C 'attack':60B 'beyond':63B 'bound':68B 'buffer':52B 'capac':91C 'count':122C 'cve':11A,14A 'end':48B,143C 'entri':106C,166C,170C 'event':38B 'fals':105C 'fill':133C 'filter':39B 'follow':78C 'go':140C 'host':23B 'incorrect':34B 'increas':111C 'initi':121C 'keep':84C,144C 'kernel':2A,19B,26B,71B,76C 'leav':161C 'limit':35B,87C,115C,150C,176C 'linux':1A,18B,25B,75C 'linux-kernel':17B 'memori':72B 'nr':97C,145C 'number':127C 'out-of-bound':65B 'pars':37B,43B,93C,117C,129C,172C 'parser':5A,31B 'past':8A,46B,141C 'pred':98C,146C 'predic':4A,30B,40B,86C,92C,118C,149C 'program':90C,131C 'reserv':100C 'resolv':82C 'run':45B 'runtim':20B 'say':57B 'self':22B 'self-host':21B 'separ':88C,154C 'size':159C 'smaller':124C 'sourc':54B 'space':162C 'stop':173C 'subsequ':137C 'subsystem':28B 'termin':102C,165C 'trace':3A,27B,83C 'true':103C 'two':95C 'use':32B,109C,152C 'valu':112C,155C 'vulner':79C 'write':7A 'zero':169C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99143","severity":null,"published_at":"2026-10-28T11:17:34+00:00","modified_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}