{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64299", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.778Z", "datePublished": "2026-07-25T08:49:35.742Z", "dateUpdated": "2026-08-05T12:40:42.636Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:40:42.636Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker installs a glob filter through tracefs or perf_event_open and triggers it using a local pathname syscall on an affected filesystem such as XFS. Network clients cannot normally install or observe the required tracing filter.\nAC:L - No race or uncontrollable timing is required; the attacker selects a full-glob pattern and triggers a non-NUL-terminated event field repeatedly. Reused per-CPU trace buffers can also be groomed by attacker-controlled events.\nPR:L - Although user namespaces alone cannot bypass tracefs or initial-namespace perf capability checks, ordinary users can install filters when tracefs access is delegated to a tracing group or perf_event_paranoid permits kernel events. These are supported and reasonable deployments requiring only basic user privileges.\nUI:N - The attacker can install the filter and trigger pathname lookups directly without another user's action.\nS:U - The out-of-bounds read affects the host kernel within the same security authority and does not cross a guest-host, hypervisor, or IOMMU boundary.\nC:H - glob_match() ignores the supplied field length and scans until an incidental NUL, allowing filter results to act as an oracle over adjacent or reused kernel trace-buffer data. The read is not strictly bounded to a few bytes.\nI:N - The vulnerable code only reads memory and changes the Boolean filter result; it provides no out-of-bounds write or other memory-modification primitive.\nA:H - The repeatable unbounded scan can cross the event allocation or page boundary, producing the reported KASAN invalid access and potentially an oops or panic on inaccessible or poisoned memory. Panic-on-warning configurations make total availability loss directly achievable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/glob.h", "kernel/trace/trace_events_filter.c", "lib/glob.c"], "versions": [{"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "265f3a690f6c7d69ef7d2ca50b04b4853a211df3", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "ee5b8888d3248618251fb69a2fad92afcb81557e", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "56d4c9ab84714eebb285a2fee68aaedf81e3ef15", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "35ae19764eabfe9c29029d3b5713c86e6855acdf", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "ebb55902856973906c8bb339a3a34824ed4a5086", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "2dad64a97e1df47f5d9ccb17fa319aa348617226", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "e5d5f3bd053a5f14787526c9f0f55ef900d43ac6", "status": "affected", "versionType": "git"}, {"version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "lessThan": "0a6070839b1ef276d5b05bedfb787743e140fb17", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/glob.h", "kernel/trace/trace_events_filter.c", "lib/glob.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.2-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3"}, {"url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e"}, {"url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15"}, {"url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf"}, {"url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086"}, {"url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226"}, {"url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6"}, {"url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17"}], "title": "tracing: Prevent out-of-bounds read in glob matching", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/glob.h", "kernel/trace/trace_events_filter.c", "lib/glob.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "265f3a690f6c7d69ef7d2ca50b04b4853a211df3", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "ee5b8888d3248618251fb69a2fad92afcb81557e", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "56d4c9ab84714eebb285a2fee68aaedf81e3ef15", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "35ae19764eabfe9c29029d3b5713c86e6855acdf", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "ebb55902856973906c8bb339a3a34824ed4a5086", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "2dad64a97e1df47f5d9ccb17fa319aa348617226", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "e5d5f3bd053a5f14787526c9f0f55ef900d43ac6", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}, {"lessThan": "0a6070839b1ef276d5b05bedfb787743e140fb17", "status": "affected", "version": "60f1d5e3bac44b598f67d36062da96c095d2b700", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/glob.h", "kernel/trace/trace_events_filter.c", "lib/glob.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour."}], "id": "CVE-2026-64299", "lastModified": "2026-08-11T15:00:57.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-25T10:17:10.793", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: tracing: Prevent out-of-bounds read in glob matching", "id": "2507227", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507227"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's tracing subsystem. This vulnerability allows a local attacker to trigger an out-of-bounds read by providing specially crafted input to glob matching functions. The issue arises because these functions did not correctly handle string event fields that were not properly terminated. Successful exploitation could lead to the disclosure of sensitive information or cause a system crash, resulting in a denial of service (DoS)."], "name": "CVE-2026-64299", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64299\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64299\nhttps://lore.kernel.org/linux-cve-announce/2026072506-CVE-2026-64299-ef17@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,265f3a690f6c7d69ef7d2ca50b04b4853a211df3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,ee5b8888d3248618251fb69a2fad92afcb81557e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,56d4c9ab84714eebb285a2fee68aaedf81e3ef15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,35ae19764eabfe9c29029d3b5713c86e6855acdf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,ebb55902856973906c8bb339a3a34824ed4a5086)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,2dad64a97e1df47f5d9ccb17fa319aa348617226)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,e5d5f3bd053a5f14787526c9f0f55ef900d43ac6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[60f1d5e3bac44b598f67d36062da96c095d2b700,0a6070839b1ef276d5b05bedfb787743e140fb17)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T12:00:11.859959+00:00", "updated": "2026-08-03T19:30:04.394371+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}