In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not… (CVE-2026-64299)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to address this issue by adding length-bounded glob matching. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating the affected Linux kernel versions once the patch is released. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.
Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.
Impact
The vulnerability causes out-of-bounds reads in kernel memory during tracing operations, which can lead to kernel memory corruption detection alerts (KASAN) and potentially destabilize the kernel. There is no indication of code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.
Summary
The Linux kernel tracing subsystem had a vulnerability (CVE-2026-64299) where string event fields that are not NUL-terminated could cause out-of-bounds reads during glob pattern matching. While most filter predicate functions respected the string length, regex_match_glob() called glob_match(), which scanned until a NUL byte, ignoring the length. This led to a kernel address sanitizer (KASAN) slab-out-of-bounds read, notably triggered via the xfs_lookup tracepoint's dynamic char array fields. The fix involved adding a length-bounded glob_match_len() function used by regex_match_glob() to ensure matching respects field boundaries, preventing out-of-bounds access.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64299 (opens in a new tab)
- git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17 (opens in a new tab)
- git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3 (opens in a new tab)
- git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226 (opens in a new tab)
- git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf (opens in a new tab)
- git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15 (opens in a new tab)
- git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6 (opens in a new tab)
- git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086 (opens in a new tab)
- git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e (opens in a new tab)