{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99143","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.395Z","datePublished":"2026-10-28T10:34:54.527Z","dateUpdated":"2026-10-31T12:43:49.775Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-31T12:43:49.775Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Keep the predicate limit separate from program capacity\n\npredicate_parse() adds two to nr_preds to reserve the terminal TRUE\nand FALSE entries. It also uses that increased value as the limit for\nparsed predicates. If the initial count is smaller than the number\nactually parsed, the program can fill the allocation and subsequent\naccesses can go past its end.\n\nKeep nr_preds as the predicate limit and use a separate value for the\nallocation size. This leaves space for both terminal entries and a\nzeroed entry when parsing stops at the limit."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attacker supplies the expression through ioctl(PERF_EVENT_IOC_SET_FILTER) on a local PERF_TYPE_TRACEPOINT fd; perf_event_set_filter() calls ftrace_profile_set_filter(), create_filter(), process_preds(), and the patched predicate_parse(). No network protocol carries the input.\nAC:L - parse_pred() accepts CPUS{0\\n'} because cpulist_parse() stops at the newline, while calc_stack() treats the quote as hiding later predicates; two such operands deterministically make predicate_parse() append TRUE/FALSE out of bounds. No race or external state is needed.\nPR:L - With sample_type=0, exclude_kernel=1, and a self target, sys_perf_event_open() creates a tracepoint counting fd without capabilities because perf_trace_event_perm() returns for the non-RAW event before perf_allow_tracepoint(). The fd owner can invoke SET_FILTER.\nUI:N - The same unprivileged process opens its own perf event and submits the crafted filter; no action by another user or administrator is required.\nS:U - predicate_parse() corrupts heap memory inside the same host kernel that enforces perf access; resulting local kernel privilege escalation does not cross a VM, IOMMU, or other security authority.\nC:H - prog[N] and prog[N+1] are accessed beyond the allocated array, and the limit error path can pass an out-of-range pred pointer to free_predicate(). On affected merged-kmalloc deployments, grooming pointer-bearing neighboring objects makes kernel-memory disclosure possible.\nI:H - The terminal target and pred stores overwrite adjacent heap words with 1 and NULL; on merged kmalloc caches an attacker can groom victim objects, allowing the out-of-bounds write to corrupt kernel control or security state and support privilege escalation.\nA:H - The out-of-bounds terminal stores or error-path processing of an adjacent pred pointer can cause invalid dereferences, invalid frees, and a kernel oops or panic; the attacker can repeat SET_FILTER submissions."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_filter.c"],"versions":[{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"f4fcbae8b27350565026807e77c96541d9e7a349","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"37049f8c56d377e46a8ef1ff93178a39a68a9c9c","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"2058a1fe791bb30fd6e4875a7ada3237076c8541","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"68ecc9510bb82dd78585c02bd5357f34ee16b153","status":"affected","versionType":"git"},{"version":"39f7c41c908bc82947ce47cdd021520ff486c53f","lessThan":"803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_filter.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.59"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f4fcbae8b27350565026807e77c96541d9e7a349"},{"url":"https://git.kernel.org/stable/c/37049f8c56d377e46a8ef1ff93178a39a68a9c9c"},{"url":"https://git.kernel.org/stable/c/2058a1fe791bb30fd6e4875a7ada3237076c8541"},{"url":"https://git.kernel.org/stable/c/68ecc9510bb82dd78585c02bd5357f34ee16b153"},{"url":"https://git.kernel.org/stable/c/803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445"}],"title":"tracing: Keep the predicate limit separate from program capacity","x_generator":{"engine":"bippy-1.2.0"}}}}