tracing: Reject incomplete event filter expressions
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSeverity
high7.8CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Fix status not established
No structured fix or guidance is available here. Check the latest publisher advisory.
What this means
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAttack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
Linux · Linux
Linux
9 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 4a1a6d35359991c5d47f4bf101cfbe1475c94093
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 2a98f5d4913ec081e08e1075512cb7ec313d9f72
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 15ff3cc7f2beecc3f95d66358f20ad7b057466aa
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before b205ff58e02922ac324f931cf9eb238a3acdb048
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 5a999b5a16530898f0dbe5f8c50fd45ea72e110b
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 1008e9e0b8280d47f1ab5e9c113f666a023a9697
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 64993d970dde2a2da353e9e99595a4fa88ec27d9
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46
git versions
80765597bc587feae8dbc8ce97a0f32e12a6e625 → before 1fdc4164e488916402badddbb1f51e9380dabb91
git versions
Other versions: unaffected
Linux · Linux
Linux
11 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
4.17
unaffected
0 → before 4.17
semver versions
5.10.273 → through 5.10.*
semver versions
5.15.224 → through 5.15.*
semver versions
6.1.191 → through 6.1.*
semver versions
6.6.161 → through 6.6.*
semver versions
6.12.115 → through 6.12.*
semver versions
6.18.60 → through 6.18.*
semver versions
7.2.14 → through 7.2.*
semver versions
7.3.1 → through 7.3.*
semver versions
7.4-rc1 → through *
original_commit_for_fix versions
Other versions: affected
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Reject incomplete event filter expressions
A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state.
For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.
Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.
References
9 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-99236View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
Linux · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 5.10.273
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 5.15.224
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 6.1.191
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 6.6.161
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 6.12.115
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 6.18.60
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 7.2.14
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 7.3.1
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 4.17
Before: 7.4-rc1
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "5.10.273"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "5.15.224"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.1.191"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.6.161"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.12.115"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "6.18.60"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "7.2.14"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "7.3.1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17",
"versionEndExcluding": "7.4-rc1"
}
]
}
]
}
]Contributing organizations · 1
Assigning organization
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changes- CVE · CVE-2026-99236
Observed 2026-11-03T19:50:45.284Z · upstream updated 2026-11-03T19:13:04.332Z
Product or version evidence changed
before
[ { "vendor": "Linux", "name": "Linux", "platforms": [], "versions": [ { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "4a1a6d35359991c5d47f4bf101cfbe1475c94093", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "2a98f5d4913ec081e08e1075512cb7ec313d9f72", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "15ff3cc7f2beecc3f95d66358f20ad7b057466aa", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "b205ff58e02922ac324f931cf9eb238a3acdb048", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "5a999b5a16530898f0dbe5f8c50fd45ea72e110b", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "1008e9e0b8280d47f1ab5e9c113f666a023a9697", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "64993d970dde2a2da353e9e99595a4fa88ec27d9", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46", "versionType": "git" } ], "defaultStatus": "unaffected", "cpes": [], "source": "Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-99236" }, { "vendor": "Linux", "name": "Linux", "platforms": [], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "status": "unaffected", "lessThan": "4.17", "versionType": "semver" }, { "version": "5.10.273", "status": "unaffected", "lessThanOrEqual": "5.10.*", "versionType": "semver" }, { "version": "5.15.224", "status": "unaffected", "lessThanOrEqual": "5.15.*", "versionType": "semver" }, { "version": "6.1.191", "status": "unaffected", "lessThanOrEqual": "6.1.*", "versionType": "semver" }, { "version": "6.6.161", "status": "unaffected", "lessThanOrEqual": "6.6.*", "versionType": "semver" }, { "version": "6.12.115", "status": "unaffected", "lessThanOrEqual": "6.12.*", "versionType": "semver" }, { "version": "6.18.60", "status": "unaffected", "lessThanOrEqual": "6.18.*", "versionType": "semver" }, { "version": "7.2.14", "status": "unaffected", "lessThanOrEqual": "7.2.*", "versionType": "semver" }, { "version": "7.3.1", "status": "unaffected", "lessThanOrEqual": "7.3.*", "versionType": "semver" } ], "defaultStatus": "affected", "cpes": [], "source": "Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-99236" } ]after
[ { "vendor": "Linux", "name": "Linux", "platforms": [], "versions": [ { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "4a1a6d35359991c5d47f4bf101cfbe1475c94093", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "2a98f5d4913ec081e08e1075512cb7ec313d9f72", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "15ff3cc7f2beecc3f95d66358f20ad7b057466aa", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "b205ff58e02922ac324f931cf9eb238a3acdb048", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "5a999b5a16530898f0dbe5f8c50fd45ea72e110b", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "1008e9e0b8280d47f1ab5e9c113f666a023a9697", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "64993d970dde2a2da353e9e99595a4fa88ec27d9", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46", "versionType": "git" }, { "version": "80765597bc587feae8dbc8ce97a0f32e12a6e625", "status": "affected", "lessThan": "1fdc4164e488916402badddbb1f51e9380dabb91", "versionType": "git" } ], "defaultStatus": "unaffected", "cpes": [], "source": "Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-99236" }, { "vendor": "Linux", "name": "Linux", "platforms": [], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "status": "unaffected", "lessThan": "4.17", "versionType": "semver" }, { "version": "5.10.273", "status": "unaffected", "lessThanOrEqual": "5.10.*", "versionType": "semver" }, { "version": "5.15.224", "status": "unaffected", "lessThanOrEqual": "5.15.*", "versionType": "semver" }, { "version": "6.1.191", "status": "unaffected", "lessThanOrEqual": "6.1.*", "versionType": "semver" }, { "version": "6.6.161", "status": "unaffected", "lessThanOrEqual": "6.6.*", "versionType": "semver" }, { "version": "6.12.115", "status": "unaffected", "lessThanOrEqual": "6.12.*", "versionType": "semver" }, { "version": "6.18.60", "status": "unaffected", "lessThanOrEqual": "6.18.*", "versionType": "semver" }, { "version": "7.2.14", "status": "unaffected", "lessThanOrEqual": "7.2.*", "versionType": "semver" }, { "version": "7.3.1", "status": "unaffected", "lessThanOrEqual": "7.3.*", "versionType": "semver" }, { "version": "7.4-rc1", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix" } ], "defaultStatus": "affected", "cpes": [], "source": "Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-99236" } ]References changed
before
[ "https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093", "https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72", "https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa", "https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048", "https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b", "https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697", "https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9", "https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46" ]
after
[ "https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093", "https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72", "https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa", "https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048", "https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b", "https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697", "https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9", "https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46", "https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91" ]
Environment requirements changed
before
[ { "source": "Linux", "statements": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.273" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.191" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.161" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.115" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.60" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.2.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.3.1" } ] } ] } ] } ]after
[ { "source": "Linux", "statements": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.273" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.224" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.191" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.161" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.115" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.60" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.2.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.3.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.4-rc1" } ] } ] } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.