CVE-2026-99236
tracing: Reject incomplete event filter expressions
What happened?
In the Linux kernel, the following vulnerability has been resolved:
tracing: Reject incomplete event filter expressions
A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state.
For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.
Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 4a1a6d35359991c5d47f4bf101cfbe1475c94093; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 2a98f5d4913ec081e08e1075512cb7ec313d9f72; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 15ff3cc7f2beecc3f95d66358f20ad7b057466aa; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < b205ff58e02922ac324f931cf9eb238a3acdb048; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 5a999b5a16530898f0dbe5f8c50fd45ea72e110b; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 1008e9e0b8280d47f1ab5e9c113f666a023a9697; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 64993d970dde2a2da353e9e99595a4fa88ec27d9; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46; affected: 80765597bc587feae8dbc8ce97a0f32e12a6e625 to < 1fdc4164e488916402badddbb1f51e9380dabb91 | See vendor advisory |
| LinuxLinux | affected: 4.17; unaffected: 0 to < 4.17; unaffected: 5.10.273 to ≤ 5.10.*; unaffected: 5.15.224 to ≤ 5.15.*; unaffected: 6.1.191 to ≤ 6.1.*; unaffected: 6.6.161 to ≤ 6.6.*; unaffected: 6.12.115 to ≤ 6.12.*; unaffected: 6.18.60 to ≤ 6.18.*; unaffected: 7.2.14 to ≤ 7.2.*; unaffected: 7.3.1 to ≤ 7.3.*; unaffected: 7.4-rc1 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99236
- https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093
- https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72
- https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa
- https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048
- https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b
- https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697
- https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9
- https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46
- https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91