CVE-2026-99236
Received Received - Intake

Memory Corruption in Linux Kernel via Incomplete Event Filter

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99236

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 80765597bc587feae8dbc8ce97a0f32e12a6e625
Linux Linux 4.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of event filter expressions in the tracing subsystem. When an expression ends with an incomplete logical operator (like && or ||) or a negation (!), the system fails to properly validate it. This can lead to out-of-bounds memory access or incorrect branch targets, potentially allowing an attacker to manipulate kernel behavior through perf tracepoints.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and may not have direct network detection methods. Check kernel logs for tracepoint-related errors or crashes using commands like 'dmesg | grep trace' or 'journalctl -k | grep trace'. Ensure your kernel version is updated to a patched release.

Impact Analysis

If exploited, this flaw could allow a local attacker with sufficient privileges to execute arbitrary code, escalate privileges, or cause a denial-of-service condition on the affected system. It primarily affects systems using the Linux kernel's tracing features with perf tracepoints.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a Linux kernel issue related to tracing event filter expressions. It could potentially impact systems processing sensitive data if exploited, but no direct compliance impact is specified.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-99236. Avoid using perf tracepoint with custom filters until the update is applied. Monitor system logs for unusual activity related to tracepoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...