CVE-2026-64028
Received Received - Intake

NULL Return in hist_field_name() in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist_field_name() on truncation hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL: strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it. system and event_name are bounded by MAX_EVENT_NAME_LEN, but the field name on a VAR_REF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path. Keep the length check but leave field_name as "" on overflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64028
EUVD
EUVD-2026-45601

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference flaw in the Linux kernel's tracing subsystem. The hist_field_name() function returns an empty string except in a specific case where snprintf() truncation can return NULL instead. Callers of this function do not handle NULL, leading to potential crashes when dereferencing the NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's tracing subsystem and does not have a direct network detection method. To check if your system is affected, verify the kernel version and whether it includes the vulnerable code path. Use commands like uname -a to check the kernel version and grep to inspect the tracing code for the affected functions.

Impact Analysis

An attacker with local access could exploit this to crash the system by triggering a NULL pointer dereference in the kernel's tracing code. This may lead to denial-of-service conditions or potential privilege escalation if combined with other vulnerabilities.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue related to tracing functionality and NULL pointer dereferencing, which does not involve data exposure or privacy violations typically addressed by these regulations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the affected tracing features or restricting access to the kernel's tracing interface until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart