In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not… (CVE-2026-64299)
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.
AI Analysis
Technical Summary
The Linux kernel tracing subsystem had a vulnerability (CVE-2026-64299) where string event fields that are not NUL-terminated could cause out-of-bounds reads during glob pattern matching. While most filter predicate functions respected the string length, regex_match_glob() called glob_match(), which scanned until a NUL byte, ignoring the length. This led to a kernel address sanitizer (KASAN) slab-out-of-bounds read, notably triggered via the xfs_lookup tracepoint's dynamic char array fields. The fix involved adding a length-bounded glob_match_len() function used by regex_match_glob() to ensure matching respects field boundaries, preventing out-of-bounds access.
Potential Impact
The vulnerability causes out-of-bounds reads in kernel memory during tracing operations, which can lead to kernel memory corruption detection alerts (KASAN) and potentially destabilize the kernel. There is no indication of code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by adding length-bounded glob matching. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating the affected Linux kernel versions once the patch is released. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not… (CVE-2026-64299)
Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel tracing subsystem had a vulnerability (CVE-2026-64299) where string event fields that are not NUL-terminated could cause out-of-bounds reads during glob pattern matching. While most filter predicate functions respected the string length, regex_match_glob() called glob_match(), which scanned until a NUL byte, ignoring the length. This led to a kernel address sanitizer (KASAN) slab-out-of-bounds read, notably triggered via the xfs_lookup tracepoint's dynamic char array fields. The fix involved adding a length-bounded glob_match_len() function used by regex_match_glob() to ensure matching respects field boundaries, preventing out-of-bounds access.
Potential Impact
The vulnerability causes out-of-bounds reads in kernel memory during tracing operations, which can lead to kernel memory corruption detection alerts (KASAN) and potentially destabilize the kernel. There is no indication of code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this issue by adding length-bounded glob matching. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating the affected Linux kernel versions once the patch is released. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fv73-wvqp-hjm7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64299"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420d9c2644c7f8085d1c
Added to database: 07/25/2026, 23:09:01 UTC
Last enriched: 07/25/2026, 23:36:56 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.