{"id":"CVE-2026-99236","published":"2026-11-02T16:17:49.003","lastModified":"2026-11-02T16:17:49.003","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Reject incomplete event filter expressions\n\nA non-empty expression normally finishes in predicate_parse()'s inner\nloop, which resolves the pending logical operators before jumping to\nfinalization. If the input ends after an operator, possibly followed by\nunary '!' tokens, the outer loop instead falls through with unresolved\noperator state.\n\nFor example, \"common_pid == 1 || common_pid == 2 &&\" leaves\nprog[0].target equal to -1. The second pass then reads prog[-1] before\nthe forward-jump check can reject it. Depending on adjacent slab\ncontents, it can also copy an out-of-bounds word into a branch target\nthat passes the forward-only check. A self-targeted perf tracepoint\ncounting event can reach this path through PERF_EVENT_IOC_SET_FILTER.\n\nReject the outer-loop fallthrough when a predicate has already been\nparsed. This ensures that non-empty expressions only reach finalization\nafter the inner loop has resolved their operators. Keep the existing\nno-filter error for input that has no predicates. Add a regression test\nfor trailing logical operators and unary negations.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697","tags":[]},{"url":"https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa","tags":[]},{"url":"https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72","tags":[]},{"url":"https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093","tags":[]},{"url":"https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b","tags":[]},{"url":"https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","tags":[]},{"url":"https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9","tags":[]},{"url":"https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}