Linux kernel: Out-of-bounds write in tracing predicate parser
Summary
The Linux kernel tracing subsystem's predicate (event filter) parser can exceed the bounds of its allocation when the number of parsed predicates reaches the limit. A local user who can configure tracing event filters may be able to corrupt kernel memory, which could lead to privilege escalation, information disclosure or a denial of service. The flaw requires local access with low privileges.
Affected
- Linux kernel versions from the introducing commit 39f7c41c908bc82947ce47cdd021520ff486c53f until the fixing commits; exact ranges are unknown and sources conflict.
- Sources list 6.6 as affected; distribution kernels may be affected from different versions (for example Alpaquita linux-lts from 6.12.112 and 6.18.58).
Fixed in
- Upstream fixing commits: 2058a1fe791bb30fd6e4875a7ada3237076c8541, 37049f8c56d377e46a8ef1ff93178a39a68a9c9c, 68ecc9510bb82dd78585c02bd5357f34ee16b153, 803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445, f4fcbae8b27350565026807e77c96541d9e7a349.
- Stable kernels: 6.6.161, 6.12.115, 6.18.59, 7.2.13 (per OSV).
- Mainline: one source reports v7.3.
- Distribution fixed package versions: Unknown.
Workaround
- No vendor workaround known.
- Until patched, limit local shell access and restrict who can use tracing interfaces on multi-user hosts.
Exploitation
- Not listed in CISA KEV.
- No public proof-of-concept found at the time of research.
Our recommendation
- Install a kernel update from your distribution that includes the upstream fix; check the Debian, Ubuntu and your distribution kernel advisories.
- Prioritise shared Linux servers, jump hosts, CI/build runners and container hosts.
- Restrict local user access and monitor for unexpected changes to tracing configuration.
- Re-check the CVE status, as NVD analysis was pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubuntu security notice CVE-2026-99143 ubuntu.com
- Bell-SW Alpaquita OSV entry osv.dev
- Upstream fix commit 2058a1fe791bb30fd6e4875a7ada3237076c8541 git.kernel.org
- Upstream fix commit 37049f8c56d377e46a8ef1ff93178a39a68a9c9c git.kernel.org
- Upstream fix commit 68ecc9510bb82dd78585c02bd5357f34ee16b153 git.kernel.org
- Upstream fix commit 803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445 git.kernel.org
- Upstream fix commit f4fcbae8b27350565026807e77c96541d9e7a349 git.kernel.org
- Vulners Debian OSV entry vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:02.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end. Keep nr_preds as the predicate limit and use a separate value for the allocation size. This leaves space for both terminal entries and a zeroed entry when parsing stops at the limit.
NVD references (5)
- https://git.kernel.org/stable/c/2058a1fe791bb30fd6e4875a7ada3237076c8541
- https://git.kernel.org/stable/c/37049f8c56d377e46a8ef1ff93178a39a68a9c9c
- https://git.kernel.org/stable/c/68ecc9510bb82dd78585c02bd5357f34ee16b153
- https://git.kernel.org/stable/c/803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445
- https://git.kernel.org/stable/c/f4fcbae8b27350565026807e77c96541d9e7a349
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.