{"id":"CVE-2026-99236","kind":"vulnerability","aliases":["CVE-2026-99236"],"related":[],"title":"Linux kernel: incomplete tracing event filter reads out-of-bounds memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.","summary":"A malformed trailing logical operator in a perf tracepoint filter makes the kernel read memory before its buffer. An attacker who can set such a filter could read or corrupt adjacent kernel memory, which may lead to privilege escalation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftrace","linux-kernel","perf","runtime","self-hosted"],"not_affected_if":["no-untrusted-local-users","perf-restricted"],"how_to_check":"- `uname -r` for the running kernel, then check your distribution's kernel changelog/advisory for commit 1fdc4164e488 or the title 'tracing: Reject incomplete event filter expressions'.\n- Bug was introduced by commit 80765597bc587 ('tracing: Rewrite filter logic to be simpler and faster'), so kernels containing it and lacking the fix are affected.\n- Exposure needs local users able to call perf_event_open + PERF_EVENT_IOC_SET_FILTER on a tracepoint event: `cat /proc/sys/kernel/perf_event_paranoid` (higher values restrict unprivileged perf).\n- Upstream selftest: tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc (run via ftracetest as root).","fix":"Upstream fix is mainline commit 1fdc4164e488916402badddbb1f51e9380dabb91 (tracing: Reject incomplete event filter expressions), queued for 7.2-stable. Move to a kernel release or distro package that includes this commit; fixed version numbers not yet confirmed.","status":"open","published_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:31+00:00","updated_at":"2026-11-02T16:28:26+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-11-02T16:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: incomplete tracing event filter reads out-of-bounds memory","impact":"high","summary":"A malformed trailing logical operator in a perf tracepoint filter makes the kernel read memory before its buffer. An attacker who can set such a filter could read or corrupt adjacent kernel memory, which may lead to privilege escalation.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","perf","ftrace","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads or corrupts adjacent kernel memory","analyst_note":"Check the upstream kernel fix commit and distribution advisories for affected and fixed kernel versions; the NVD entry gives no version ranges.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the kernel includes the fix for tracing: Reject incomplete event filter expressions in your distribution's advisory\n- Confirm perf tracepoint filtering is in use: `cat /proc/sys/kernel/perf_event_paranoid`","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users","perf-restricted"],"who_is_affected":"Systems running a Linux kernel with the tracing subsystem, where local users can call PERF_EVENT_IOC_SET_FILTER on a tracepoint counting event. Exposure depends on who can run perf on the host, so multi-user Linux servers and shared build hosts are the places to look. Hosts where only trusted administrators have perf access can deprioritise it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4419,"output_tokens":618,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the upstream kernel fix commit and distribution advisories for affected and fixed kernel versions; the NVD entry gives no version ranges.","search":"'-1':142C,149C '-2026':14A,17A '-99236':15A,18A '0':138C '1':132C '2':135C 'add':247C 'adjac':58B,161C 'alreadi':213C 'also':166C 'attack':47B 'bound':11A,172C 'branch':176C 'buffer':45B 'check':155C,184C 'common':130C,133C 'content':163C 'copi':167C 'corrupt':57B 'could':54B 'count':191C 'cve':13A,16A 'depend':159C 'empti':86C,221C 'end':109C 'ensur':217C 'equal':140C 'error':240C 'escal':66B 'event':5A,80C,192C,199C 'exampl':129C 'exist':236C 'express':82C,87C,222C 'fall':122C 'fallthrough':208C 'filter':6A,37B,53B,81C,202C,239C 'final':105C,225C 'finish':89C 'follow':72C,114C 'forward':153C,182C 'forward-jump':152C 'forward-on':181C 'ftrace':19B 'host':27B 'incomplet':3A,79C 'inner':94C,228C 'input':108C,242C 'instead':121C 'ioc':200C 'jump':103C,154C 'keep':234C 'kernel':2A,22B,40B,59B,70C 'lead':63B 'leav':136C 'linux':1A,21B,69C 'linux-kernel':20B 'logic':31B,100C,253C 'loop':95C,120C,207C,229C 'make':38B 'malform':29B 'may':62B 'memori':12A,42B,60B 'negat':257C 'no-filt':237C 'non':85C,220C 'non-empti':84C,219C 'normal':88C 'oper':32B,101C,112C,126C,233C,254C 'out-of-bound':8A,169C 'outer':119C,206C 'outer-loop':205C 'pars':92C,215C 'pass':145C,179C 'path':196C 'pend':99C 'perf':23B,35B,189C,198C 'pid':131C,134C 'possibl':113C 'predic':91C,211C,246C 'privileg':65B 'prog':137C,148C 'reach':194C,224C 'read':7A,41B,55B,147C 'regress':249C 'reject':78C,157C,203C 'resolv':76C,97C,231C 'runtim':24B 'second':144C 'self':26B,187C 'self-host':25B 'self-target':186C 'set':50B,201C 'slab':162C 'state':127C 'target':139C,177C,188C 'test':250C 'token':117C 'trace':4A,77C 'tracepoint':36B,190C 'trail':30B,252C 'unari':116C,256C 'unresolv':125C 'vulner':73C 'word':173C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the tracing subsystem, where local users can call PERF_EVENT_IOC_SET_FILTER on a tracepoint counting event. Exposure depends on who can run perf on the host, so multi-user Linux servers and shared build hosts are the places to look. Hosts where only trusted administrators have perf access can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ftrace","high","linuxkernel","perf","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99236","severity":null,"published_at":"2026-11-02T16:17:49+00:00","modified_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99236:1391","url":null,"severity":null,"published_at":"2026-11-02T16:28:26+00:00","modified_at":"2026-11-02T16:28:26+00:00","first_seen_at":"2026-11-02T16:28:26+00:00","fetched_at":"2026-11-02T16:28:26+00:00","note":"Read upstream fix commit 1fdc4164e488 (Rostedt tree, 2026-10-24) and 7.2-stable review patch. Bug introduced by 80765597bc587 (filter rewrite); fixed release numbers not published in sources read, so unknown. No exploitation or PoC seen. Distro advisories not checked/found."}],"documents":[{"id":52853,"url":"https://repo.or.cz/linux.git/commit/1fdc4164e488916402badddbb1f51e9380dabb91","title":"tracing: Reject incomplete event filter expressions (1fdc4164e488)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":52854,"url":"https://ci.syzbot.org/patches/653fddb9-ee7d-4da5-989f-2cd6a4f382c0","title":"7.2-stable review patch: tracing: Reject incomplete event filter expressions","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}