CVE-2026-64299

CVE CVE-2026-64299EUVD EUVD-2026-49011Published 2026-07-25T08:49:35.000ZLast changed 2026-08-05T12:40:42.000ZCVSS 7.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 60f1d5e3bac44b598f67d36062da96c095d2b700 <56d4c9ab84714eebb285a2fee68aaedf81e3ef15; patch: 0; 60f1d5e3bac44b598f67d36062da96c095d2b700 <2dad64a97e1df47f5d9ccb17fa319aa348617226; patch: 6.6.145; patch: 6.18.39; 60f1d5e3bac44b598f67d36062da96c095d2b700 <e5d5f3bd053a5f14787526c9f0f55ef900d43ac6; patch: 5.15.212; 4.10; patch: 7.1.4; patch: 7.2-rc3; 60f1d5e3bac44b598f67d36062da96c095d2b700 <265f3a690f6c7d69ef7d2ca50b04b4853a211df3; patch: 6.12.96; patch: 6.1.178; 60f1d5e3bac44b598f67d36062da96c095d2b700 <0a6070839b1ef276d5b05bedfb787743e140fb17; 60f1d5e3bac44b598f67d36062da96c095d2b700 <35ae19764eabfe9c29029d3b5713c86e6855acdf; 60f1d5e3bac44b598f67d36062da96c095d2b700 <ebb55902856973906c8bb339a3a34824ed4a5086; 60f1d5e3bac44b598f67d36062da96c095d2b700 <ee5b8888d3248618251fb69a2fad92afcb81557e; patch: 5.10.261

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.