CVE-2026-64299 tracing: Prevent out-of-bounds read in glob matching
An out-of-bounds read in Linux kernel tracing allows attackers to read sensitive memory contents via glob matching on non-terminated string fields.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64299?
CVE-2026-64299 is a high-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Prevent out-of-bounds read in glob matching
String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it.
regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint.
Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.
Weakness: CWE-125
Which versions are affected by CVE-2026-64299?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64299?
Apply the vendor's patch.
Is CVE-2026-64299 being exploited?
There is no known exploitation of CVE-2026-64299 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93716, BELL-CVE-2026-64299, DEBIAN-CVE-2026-64299, GHSA-fv73-wvqp-hjm7, ROOT-OS-DEBIAN-12-CVE-2026-64299, ROOT-OS-UBUNTU-2204-CVE-2026-64299 and 1 more.