---
id: "CVE-2026-99236"
kind: "vulnerability"
aliases: ["CVE-2026-99236"]
title: "Linux kernel: incomplete tracing event filter reads out-of-bounds memory"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ftrace", "linux-kernel", "perf", "runtime", "self-hosted"]
not_affected_if: ["no-untrusted-local-users", "perf-restricted"]
published_at: "2026-11-02T16:17:49+00:00"
first_seen_at: "2026-11-02T16:24:06+00:00"
updated_at: "2026-11-02T16:28:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99236", "first_seen_at": "2026-11-02T16:24:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:28:26+00:00"}]
---

# Linux kernel: incomplete tracing event filter reads out-of-bounds memory

A malformed trailing logical operator in a perf tracepoint filter makes the kernel read memory before its buffer. An attacker who can set such a filter could read or corrupt adjacent kernel memory, which may lead to privilege escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` for the running kernel, then check your distribution's kernel changelog/advisory for commit 1fdc4164e488 or the title 'tracing: Reject incomplete event filter expressions'.
- Bug was introduced by commit 80765597bc587 ('tracing: Rewrite filter logic to be simpler and faster'), so kernels containing it and lacking the fix are affected.
- Exposure needs local users able to call perf_event_open + PERF_EVENT_IOC_SET_FILTER on a tracepoint event: `cat /proc/sys/kernel/perf_event_paranoid` (higher values restrict unprivileged perf).
- Upstream selftest: tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc (run via ftracetest as root).

## Fix

Upstream fix is mainline commit 1fdc4164e488916402badddbb1f51e9380dabb91 (tracing: Reject incomplete event filter expressions), queued for 7.2-stable. Move to a kernel release or distro package that includes this commit; fixed version numbers not yet confirmed.

## Timeline

- 2026-11-02T16:24:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99236
- 2026-11-02T16:28:26+00:00 analyst — Read upstream fix commit 1fdc4164e488 (Rostedt tree, 2026-10-24) and 7.2-stable review patch. Bug introduced by 80765597bc587 (filter rewrite); fixed release numbers not published in sources read, so unknown. No exploitation or PoC seen. Distro advisories not checked/found.

## Documents

- [advisory] tracing: Reject incomplete event filter expressions (1fdc4164e488) https://repo.or.cz/linux.git/commit/1fdc4164e488916402badddbb1f51e9380dabb91
- [fix] 7.2-stable review patch: tracing: Reject incomplete event filter expressions https://ci.syzbot.org/patches/653fddb9-ee7d-4da5-989f-2cd6a4f382c0

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tracing: Reject incomplete event filter expressions

A non-empty expression normally finishes in predicate_parse()'s inner
loop, which resolves the pending logical operators before jumping to
finalization. If the input ends after an operator, possibly followed by
unary '!' tokens, the outer loop instead falls through with unresolved
operator state.

For example, "common_pid == 1 || common_pid == 2 &&" leaves
prog[0].target equal to -1. The second pass then reads prog[-1] before
the forward-jump check can reject it. Depending on adjacent slab
contents, it can also copy an out-of-bounds word into a branch target
that passes the forward-only check. A self-targeted perf tracepoint
counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.

Reject the outer-loop fallthrough when a predicate has already been
parsed. This ensures that non-empty expressions only reach finalization
after the inner loop has resolved their operators. Keep the existing
no-filter error for input that has no predicates. Add a regression test
for trailing logical operators and unary negations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_