CVE-2026-64299

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Prevent out-of-bounds read in glob matching

String event fields are not necessarily NUL-terminated, so the filter

predicate functions (filter_pred_string(), filter_pred_strloc() and

filter_pred_strrelloc()) pass the field length to the regex match

callbacks, and the length-aware matchers honour it.

regex_match_glob() was the exception: it ignored the length and called

glob_match(), which scans the string until it hits a NUL byte. Some

string fields are not NUL-terminated. One example is the dynamic char

array of the xfs_* namespace tracepoints, which is copied without a

trailing NUL. For such a field, glob matching reads past the end of

the event field, causing a KASAN slab-out-of-bounds read in

glob_match(), reached via regex_match_glob() and filter_match_preds()

from the xfs_lookup tracepoint.

Add a length-bounded glob_match_len() and use it from regex_match_glob()

so glob matching always stops at the fi

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References