From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5518353A76 for ; Sat, 25 Jul 2026 08:52:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969558; cv=none; b=rg7d+Z55VHevRUiTd+Ijc+t/BCT48yTMa1lrIoT66DKNKqtD/lDN+HBZbed0F8T4PKxv2AWWf0Eyi2Oychrm51ai+3pSxQKTRC7wgPUYnuBcRLzwbHmIF91tGFdnWBNPwYxBP1Nq16WHNCwoCUPNrztK/LSuEQhICZCwg7ZNlrQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784969558; c=relaxed/simple; bh=EozU159hHAR0K0EDgbteob9yHiWOKhJ5g1F/uzmoPC8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=r5yZyYcAirnw8tD3Br9zH85wRPWoRwhY7ypwdSqst8kC51W27vEg9J12Ijlr2d6bTKvSPEhupnq6FBGz6VRlQHa76XQdHYL+DOrlZVxSj3Pyj+pej1WVA6klar1TDdTytjYCVNKT3FPkaUfiODKgfm4q1NtIIuBVibUukuNXVAE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=h03VdlPr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="h03VdlPr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53ACC1F000E9; Sat, 25 Jul 2026 08:52:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784969556; bh=gkT4lPSii8wEeRPmLeONvfEr+SbYo4Hoy5lyIylXfeQ=; h=From:To:Cc:Subject:Date:Reply-To; b=h03VdlPrdI55ITqgYgwdCOl7pDnKahZ+BCyaPkWDPFgL/9oYbYHyrKD+hcNIJ6hHq QkL34uYBWP+xdf9TpUgDzo/exztYmNSiIwfS238F43d0ZmMpOrhTuRMw/+CJeF1e1t /FByMyhp9Yy6vIfy3Wq2R+XRydaIN1kHmmcZjSq4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching Date: Sat, 25 Jul 2026 10:48:36 +0200 Message-ID: <2026072506-CVE-2026-64299-ef17@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4178; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=oSsqd0/r0EQPIQ+OmfELt3DlffW0lqs/M2yzFQxTNxQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkpFW7XL3E5qp7LtlpeK/r1wNH/yuUPXhZslWAO/yYbE Vut69jTEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABNZtJFhwd5Hic84Llgw9so4 fgxsyEt59cesimF+rWBBynKpx2ek5hiorVqi8NDi1lN2AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour. The Linux kernel CVE team has assigned CVE-2026-64299 to this issue. Affected and fixed versions =========================== Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 5.10.261 with commit 265f3a690f6c7d69ef7d2ca50b04b4853a211df3 Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 5.15.212 with commit ee5b8888d3248618251fb69a2fad92afcb81557e Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.1.178 with commit 56d4c9ab84714eebb285a2fee68aaedf81e3ef15 Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.6.145 with commit 35ae19764eabfe9c29029d3b5713c86e6855acdf Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.12.96 with commit ebb55902856973906c8bb339a3a34824ed4a5086 Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.18.39 with commit 2dad64a97e1df47f5d9ccb17fa319aa348617226 Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 7.1.4 with commit e5d5f3bd053a5f14787526c9f0f55ef900d43ac6 Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 7.2-rc3 with commit 0a6070839b1ef276d5b05bedfb787743e140fb17 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64299 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/glob.h kernel/trace/trace_events_filter.c lib/glob.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3 https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15 https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086 https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226 https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6 https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17