{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99142","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.395Z","datePublished":"2026-10-28T10:34:53.839Z","dateUpdated":"2026-10-31T12:43:44.895Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-31T12:43:44.895Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Check operator stack capacity before pushing\n\npredicate_parse() uses the first operator stack entry before processing\nany opening parentheses. A push then increments top before writing.\nThe existing check still permits that write when top already points to\nthe last allocated entry, which can access beyond the operator stack.\n\nReject the push when top reaches the last allocated entry."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attacker supplies the malformed filter through PERF_EVENT_IOC_SET_FILTER; perf_event_set_filter() calls ftrace_profile_set_filter(), create_filter(), process_preds(), and the patched predicate_parse(), with no network input.\nAC:L - In an ipi_send_cpumask filter, an embedded newline makes parse_pred()->cpulist_parse() accept a CPUS{} prefix while calc_stack() counts later fake parentheses, deterministically making nr_parens too small without a race or external state.\nPR:L - An unprivileged process can open a self-targeted PERF_TYPE_TRACEPOINT counting event with exclude_kernel=1 and no PERF_SAMPLE_RAW: sys_perf_event_open() skips perf_allow_kernel(), and perf_trace_event_perm() returns before perf_allow_tracepoint().\nUI:N - The attacking process performs both perf_event_open() and PERF_EVENT_IOC_SET_FILTER itself; no victim must mount, open, or process anything.\nS:U - predicate_parse() corrupts the host kernel heap within the same kernel security authority; it does not cross a guest-host, IOMMU, or other security boundary.\nC:N - The faulty operation is write-only: *(++top) = invert can overwrite at most two adjacent 32-bit words, and this parsing path neither returns adjacent kernel memory nor supplies a demonstrated read primitive.\nI:H - Because op_stack has nr_parens integer slots, the pre-increment push can write one or two attacker-controlled 32-bit entries beyond the allocation, modifying an adjacent slab object.\nA:H - The out-of-bounds writes can corrupt a neighboring slab object or freelist state, causing a kernel oops or panic when the damaged object or cache entry is subsequently used."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_filter.c"],"versions":[{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"c43c41ec62ca54ae145aa4912c6692a26d625734","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"d6f0006f194db49c54117ae22146421da5a2ca59","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"a866a8a753922cdf7710b8eb3f686dc0efc06505","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"75e894f92417390f0ef44fd350f2d3634c784876","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"c47a7b11bcb3d45e29723afcf6336866476b1d08","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_filter.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.59"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c43c41ec62ca54ae145aa4912c6692a26d625734"},{"url":"https://git.kernel.org/stable/c/d6f0006f194db49c54117ae22146421da5a2ca59"},{"url":"https://git.kernel.org/stable/c/a866a8a753922cdf7710b8eb3f686dc0efc06505"},{"url":"https://git.kernel.org/stable/c/75e894f92417390f0ef44fd350f2d3634c784876"},{"url":"https://git.kernel.org/stable/c/c47a7b11bcb3d45e29723afcf6336866476b1d08"}],"title":"tracing: Check operator stack capacity before pushing","x_generator":{"engine":"bippy-1.2.0"}}}}