https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 14:31:05 +0000 https://db.gcve.eu/vuln/cve-2026-99236 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tracing: Reject incomplete event filter expressions</p> <p>A non-empty expression normally finishes in predicate_parse()&#39;s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary &#39;!&#39; tokens, the outer loop instead falls through with unresolved operator state.</p> <p>For example, &#34;common_pid == 1 || common_pid == 2 &amp;&amp;&#34; leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.</p> <p>Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tracing: Reject incomplete event filter expressions</p> <p>A non-empty expression normally finishes in predicate_parse()&#39;s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary &#39;!&#39; tokens, the outer loop instead falls through with unresolved operator state.</p> <p>For example, &#34;common_pid == 1 || common_pid == 2 &amp;&amp;&#34; leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.</p> <p>Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.</p> https://db.gcve.eu/vuln/cve-2026-99236