CVE-2026-99142 tracing: Check operator stack capacity before pushing

Not scored Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-99142?

CVE-2026-99142 is a vulnerability in Linux, published on 28 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Check operator stack capacity before pushing

predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that write when top already points to the last allocated entry, which can access beyond the operator stack.

Reject the push when top reaches the last allocated entry.

Which versions are affected by CVE-2026-99142?

How do I fix CVE-2026-99142?

Upgrade to a fixed version.

Is CVE-2026-99142 being exploited?

There is no known exploitation of CVE-2026-99142 in the wild and no public exploit code.

Sources

Also known as AZL-111269, BELL-CVE-2026-99142, DEBIAN-CVE-2026-99142, GHSA-cx2v-gr95-582j, UBUNTU-CVE-2026-99142.