CVE-2026-99236

Status: UPDATED  |  Advisory ID: CVE-2026-99236

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

tracing: Reject incomplete event filter expressions

A non-empty expression normally finishes in predicate_parse()'s inner

loop, which resolves the pending logical operators before jumping to

finalization. If the input ends after an operator, possibly followed by

unary '!' tokens, the outer loop instead falls through with unresolved

operator state.

For example, "common_pid == 1 || common_pid == 2 &&" leaves

prog[0].target equal to -1. The second pass then reads prog[-1] before

the forward-jump check can reject it. Depending on adjacent slab

contents, it can also copy an out-of-bounds word into a branch target

that passes the forward-only check. A self-targeted perf tracepoint

counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.

Reject the outer-loop fallthrough when a predicate has already been

parsed. This ensures that non-empty expressions only reach finalization

after the inner loop has resolved their operators. Keep the existing

no-filter error for input that has no predicates. Add a regression test

for trailing logical operators and unary negations. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References