CVE-2026-64028: Linux Kernel Tracing NULL Vulnerability

CVE-2026-64028 Overview

CVE-2026-64028 is a Linux kernel vulnerability in the tracing subsystem. The hist_field_name() function can return NULL when a fully-qualified VAR_REF or EXPR histogram field name is truncated by snprintf(). Callers such as strcat() at trace_events_hist.c:1758 and the strcmp() inside the sort-key match loop at line 4804 dereference the returned pointer without a NULL check. A sufficiently long histogram variable name in a fully qualified reference reaches the truncation path and triggers the fault.

Critical Impact
A local user with permission to install histogram triggers can supply an oversized variable name to cause a NULL pointer dereference in the kernel tracing code, resulting in a kernel crash and denial of service.

Affected Products

Linux kernel branches containing the histogram triggers tracing feature (kernel/trace/trace_events_hist.c)
Stable kernel trees updated by commits 0402a1d, 37377b3, 576ec04, 915c125, be4e990, d6c8b3e, e3f5d42, and e916876
Distribution kernels shipping the vulnerable hist_field_name() implementation prior to the referenced fixes

Discovery Timeline

2026-07-19 - CVE-2026-64028 published to the National Vulnerability Database
2026-07-19 - Last updated in the NVD database

Technical Details for CVE-2026-64028

Vulnerability Analysis

The defect lives in hist_field_name() inside the kernel's event histogram implementation. The function is designed to always return a printable string, returning an empty string "" in most code paths. In the fully-qualified VAR_REF and EXPR case, the function builds the qualified name using snprintf(). When the destination buffer is too small, snprintf() reports truncation and the code returns NULL early, bypassing the final guard that would otherwise convert NULL to "".

Downstream callers assume the contract holds. The strcat(expr, hist_field_name(field, 0)) call at trace_events_hist.c:1758 and the strcmp() comparison in the sort-key match loop at line 4804 dereference the returned pointer directly. Dereferencing NULL in kernel context triggers an oops and typically kills the offending task or panics the host depending on kernel configuration [CWE-476].

Root Cause

The system and event_name components of a histogram field reference are bounded by MAX_EVENT_NAME_LEN. The variable name portion of a VAR_REF, however, is kstrdup'd from a histogram variable declaration parsed out of the trigger string and carries no length cap. A qualified name of the form system.event.variable therefore has an unbounded total length. When this concatenation exceeds the internal snprintf() buffer, truncation returns NULL instead of the fallback empty string.

Attack Vector

Exploitation requires local access with permission to write to the tracing filesystem, typically /sys/kernel/tracing/events/*/*/trigger. An attacker crafts a histogram trigger containing a very long variable name and issues a fully-qualified reference to that variable. When the tracing subsystem walks the histogram fields and calls hist_field_name(), the truncation branch returns NULL, and the subsequent strcat() or strcmp() operation dereferences the invalid pointer. The result is a kernel crash and loss of availability. The fix keeps the length check but leaves field_name as "" on overflow, preserving the callers' assumption.

No verified proof-of-concept code has been published. The vulnerable behavior can be reproduced by inspecting the fix commits referenced under git.kernel.org stable commits.

Detection Methods for CVE-2026-64028

Indicators of Compromise

Kernel oops messages referencing hist_field_name, event_hist_trigger, or nearby symbols in kernel/trace/trace_events_hist.c
Unexpected panics or task crashes correlated with writes to /sys/kernel/tracing/events/*/*/trigger
Presence of histogram trigger strings containing unusually long variable names in tracing configuration

Detection Strategies

Audit access to the tracefs and debugfs mount points, since histogram trigger installation requires write permission to those interfaces
Alert on non-root or non-observability accounts writing to trigger files under /sys/kernel/tracing or /sys/kernel/debug/tracing
Compare running kernel version and build against the fix commits 0402a1d, 37377b3, 576ec04, 915c125, be4e990, d6c8b3e, e3f5d42, and e91687643c440ca3997d67646e6f80b92edc6703

Monitoring Recommendations

Forward /dev/kmsg and journalctl -k output to a central logging platform and alert on kernel oops entries mentioning tracing symbols
Track process activity that opens tracefs paths using auditd rules on /sys/kernel/tracing and /sys/kernel/debug/tracing
Include this CVE in kernel patch compliance dashboards until all Linux hosts report a fixed build

EPSS scoring places this issue at a low exploitation probability, consistent with a locally triggerable denial-of-service condition that requires elevated tracing permissions.

How to Mitigate CVE-2026-64028

Immediate Actions Required

Update the kernel to a stable release that includes the referenced fix commits, then reboot affected hosts
Restrict write access to /sys/kernel/tracing and /sys/kernel/debug/tracing so that only trusted observability tooling can install triggers
Remove any existing histogram triggers that use unusually long variable names until the patched kernel is deployed

Patch Information

The upstream fix keeps the truncation length check but sets field_name to "" instead of returning NULL, restoring the invariant that callers rely on. The change is distributed across multiple stable trees in the following commits: 0402a1d, 37377b3, 576ec04, 915c125, be4e990, d6c8b3e, e3f5d42, and e9168764.

Workarounds

Unmount or restrict tracefs on production hosts that do not require live histogram tracing: mount -o remount,mode=0700 /sys/kernel/tracing
Set kernel.perf_event_paranoid and standard capability boundaries so that unprivileged users cannot reach the tracing trigger interface
Where tracing is required, cap histogram variable names to a short length in configuration management to keep qualified references below the internal buffer size

bash

# Restrict tracefs to root until the kernel is patched
chown root:root /sys/kernel/tracing
chmod 700 /sys/kernel/tracing
mount -o remount,mode=0700 /sys/kernel/tracing

# Verify running kernel includes the fix commit
dmesg | grep -i "hist_field_name" || echo "no historical oops present"
uname -r