CVE-2026-64299 (GCVE-0-2026-64299)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
tracing: Prevent out-of-bounds read in glob matching
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the field boundary. The matching loop is factored into a shared helper so glob_match() keeps its behaviour.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < 265f3a690f6c7d69ef7d2ca50b04b4853a211df3 (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < ee5b8888d3248618251fb69a2fad92afcb81557e (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < 56d4c9ab84714eebb285a2fee68aaedf81e3ef15 (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < 35ae19764eabfe9c29029d3b5713c86e6855acdf (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < ebb55902856973906c8bb339a3a34824ed4a5086 (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < 2dad64a97e1df47f5d9ccb17fa319aa348617226 (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < e5d5f3bd053a5f14787526c9f0f55ef900d43ac6 (git)
Affected: 60f1d5e3bac44b598f67d36062da96c095d2b700 , < 0a6070839b1ef276d5b05bedfb787743e140fb17 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/glob.h",
            "kernel/trace/trace_events_filter.c",
            "lib/glob.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "265f3a690f6c7d69ef7d2ca50b04b4853a211df3",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "ee5b8888d3248618251fb69a2fad92afcb81557e",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "56d4c9ab84714eebb285a2fee68aaedf81e3ef15",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "35ae19764eabfe9c29029d3b5713c86e6855acdf",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "ebb55902856973906c8bb339a3a34824ed4a5086",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "2dad64a97e1df47f5d9ccb17fa319aa348617226",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "e5d5f3bd053a5f14787526c9f0f55ef900d43ac6",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "0a6070839b1ef276d5b05bedfb787743e140fb17",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/glob.h",
            "kernel/trace/trace_events_filter.c",
            "lib/glob.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker installs a glob filter through tracefs or perf_event_open and triggers it using a local pathname syscall on an affected filesystem such as XFS. Network clients cannot normally install or observe the required tracing filter.\nAC:L - No race or uncontrollable timing is required; the attacker selects a full-glob pattern and triggers a non-NUL-terminated event field repeatedly. Reused per-CPU trace buffers can also be groomed by attacker-controlled events.\nPR:L - Although user namespaces alone cannot bypass tracefs or initial-namespace perf capability checks, ordinary users can install filters when tracefs access is delegated to a tracing group or perf_event_paranoid permits kernel events. These are supported and reasonable deployments requiring only basic user privileges.\nUI:N - The attacker can install the filter and trigger pathname lookups directly without another user\u0027s action.\nS:U - The out-of-bounds read affects the host kernel within the same security authority and does not cross a guest-host, hypervisor, or IOMMU boundary.\nC:H - glob_match() ignores the supplied field length and scans until an incidental NUL, allowing filter results to act as an oracle over adjacent or reused kernel trace-buffer data. The read is not strictly bounded to a few bytes.\nI:N - The vulnerable code only reads memory and changes the Boolean filter result; it provides no out-of-bounds write or other memory-modification primitive.\nA:H - The repeatable unbounded scan can cross the event allocation or page boundary, producing the reported KASAN invalid access and potentially an oops or panic on inaccessible or poisoned memory. Panic-on-warning configurations make total availability loss directly achievable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:57.094Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e"
        },
        {
          "url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15"
        },
        {
          "url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17"
        }
      ],
      "title": "tracing: Prevent out-of-bounds read in glob matching",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64299",
    "datePublished": "2026-07-25T08:49:35.742Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-17T04:52:57.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64299",
      "date": "2026-09-22",
      "epss": "0.00164",
      "percentile": "0.06042"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:46:50.000Z",
      "cve": "CVE-2026-64299",
      "id": "msrc_CVE-2026-64299",
      "initial_release_date": "2026-07-26T01:04:29.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing: Prevent out-of-bounds read in glob matching",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64299.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/glob.h",
                  "kernel/trace/trace_events_filter.c",
                  "lib/glob.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "265f3a690f6c7d69ef7d2ca50b04b4853a211df3",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ee5b8888d3248618251fb69a2fad92afcb81557e",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "56d4c9ab84714eebb285a2fee68aaedf81e3ef15",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35ae19764eabfe9c29029d3b5713c86e6855acdf",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ebb55902856973906c8bb339a3a34824ed4a5086",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2dad64a97e1df47f5d9ccb17fa319aa348617226",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5d5f3bd053a5f14787526c9f0f55ef900d43ac6",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0a6070839b1ef276d5b05bedfb787743e140fb17",
                    "status": "affected",
                    "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/glob.h",
                  "kernel/trace/trace_events_filter.c",
                  "lib/glob.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.10"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB433E60-C109-4D5C-8AF1-149769CD0345",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "1FC0D50D-9D58-4947-A197-A5A3FF07E7E3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour."
          }
        ],
        "id": "CVE-2026-64299",
        "lastModified": "2026-09-03T16:12:34.597",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:10.793",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T08:43:22+00:00",
      "cve": "CVE-2026-64299",
      "id": "CVE-2026-64299",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing: Prevent out-of-bounds read in glob matching",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64299.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:52:27Z",
      "cve": "CVE-2026-64299",
      "id": "CVE-2026-64299",
      "initial_release_date": "2026-07-25T16:46:16Z",
      "product_status:known_affected": "370",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64299",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64299.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.