CVE-2026-64299: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64299 Overview

CVE-2026-64299 is an out-of-bounds read vulnerability in the Linux kernel's tracing subsystem. The flaw resides in the glob matching logic used by trace event filter predicates. The regex_match_glob() function ignored the field length passed by callers and instead relied on glob_match(), which scans strings until a NUL byte is encountered. Because some string event fields, such as the dynamic char arrays used by xfs_* namespace tracepoints, are copied without a trailing NUL, matching reads past the end of the event field. This triggers a KASAN slab-out-of-bounds read reachable through the xfs_lookup tracepoint and filter_match_preds().

Critical Impact
Local users with permission to configure tracing filters can trigger kernel out-of-bounds reads, potentially leaking adjacent slab memory or causing availability impact.

Affected Products

Linux kernel (tracing subsystem, regex_match_glob() in trace event filter predicates)
Systems using xfs_* tracepoints where dynamic char arrays are copied without NUL termination
Multiple stable kernel branches receiving the fix via commits 0a60708, 265f3a6, 2dad64a, 35ae197, 56d4c9a, e5d5f3b, ebb5590, and ee5b888

Discovery Timeline

2026-07-25 - CVE-2026-64299 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64299

Vulnerability Analysis

The Linux kernel tracing subsystem allows users to define filter predicates on string fields recorded by trace events. String event fields are not guaranteed to be NUL-terminated, so the filter predicate functions filter_pred_string(), filter_pred_strloc(), and filter_pred_strrelloc() pass an explicit field length to the regex match callbacks. Length-aware matchers respect this bound.

The regex_match_glob() callback did not honor the length parameter. It invoked glob_match(), which walks the input until it reads a NUL byte. When the underlying trace field lacks a trailing NUL, glob_match() continues reading beyond the allocated slab object.

Root Cause

The root cause is a missing bounds check in the glob matching path. glob_match() was written to operate on NUL-terminated C strings, while the tracing filter contract passes explicit lengths because event fields may omit the terminator. The mismatch between these two contracts causes regex_match_glob() to dereference memory outside the field's allocation. This is an Out-of-Bounds Read defect in kernel code paths reachable from unprivileged tracing configurations on systems where tracing is exposed to local users.

Attack Vector

Exploitation is local. An attacker who can write filter expressions to a tracing instance and enable an affected tracepoint, such as xfs_lookup, can cause the kernel to perform out-of-bounds reads. The read can disclose kernel slab memory contents through subsequent match behavior or crash the kernel when KASAN or hardened allocators detect the violation, resulting in denial of service. No user interaction is required beyond the attacker's own tracing configuration.

See the upstream fix in Kernel Git Commit 0a60708 for the implementation details. The patch introduces a length-bounded glob_match_len() helper and routes regex_match_glob() through it, factoring the matching loop into a shared helper so glob_match() retains its NUL-terminated behavior.

Detection Methods for CVE-2026-64299

Indicators of Compromise

KASAN reports in dmesg referencing slab-out-of-bounds inside glob_match or regex_match_glob
Kernel oops or panic entries in system logs originating from filter_match_preds() call chains
Unexpected enabling of xfs_* tracepoints or new glob-style filter predicates written to /sys/kernel/tracing/events/*/filter

Detection Strategies

Monitor writes to tracefs filter files, particularly filter expressions containing glob wildcard characters such as * and ?
Audit which users and containers hold CAP_SYS_ADMIN or otherwise have access to the tracing filesystem
Alert on kernel log messages emitted by KASAN, KFENCE, or slab corruption detectors that reference the tracing subsystem

Monitoring Recommendations

Ingest dmesg and journald kernel logs into a centralized analytics platform and search for glob_match and regex_match_glob frames
Track kernel version inventory across the fleet and flag hosts running kernels that predate the referenced stable commits
Correlate tracepoint enablement events with subsequent kernel warnings to identify local abuse attempts

How to Mitigate CVE-2026-64299

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix commits (0a60708, 265f3a6, 2dad64a, 35ae197, 56d4c9a, e5d5f3b, ebb5590, ee5b888) as soon as vendor packages are available
Restrict access to /sys/kernel/tracing and /sys/kernel/debug/tracing to trusted administrators only
Review container and sandbox configurations to ensure tracing filesystems are not exposed to untrusted workloads

Patch Information

The fix adds a length-bounded matcher glob_match_len() and updates regex_match_glob() to use it, ensuring glob matching stops at the event field boundary. Distribution vendors are shipping backports across supported stable branches; see the referenced commits under git.kernel.org stable tree and confirm your distribution's kernel package includes the change.

Workarounds

Remove or restrict mount access to tracefs and debugfs for non-administrative users until patches are applied
Disable glob-style filter predicates by avoiding wildcard characters in filter expressions on unpatched kernels
Where feasible, disable the affected xfs_* tracepoints or unload tracing infrastructure on production hosts that do not require it

bash

# Restrict tracefs access to root only
mount -o remount,mode=0700 /sys/kernel/tracing
chmod 700 /sys/kernel/debug/tracing 2>/dev/null || true

# Verify running kernel version against vendor advisory
uname -r