---
id: CVE-2026-99236
title: 'tracing: Reject incomplete event filter expressions'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tracing: Reject incomplete event filter expressions

  A non-empty expression normally finishes in predicate_parse()'s inner
  loop, which resolves the pending logical oper…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    4a1a6d35359991c5d47f4bf101cfbe1475c94093
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    2a98f5d4913ec081e08e1075512cb7ec313d9f72
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    15ff3cc7f2beecc3f95d66358f20ad7b057466aa
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    b205ff58e02922ac324f931cf9eb238a3acdb048
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    5a999b5a16530898f0dbe5f8c50fd45ea72e110b
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    1008e9e0b8280d47f1ab5e9c113f666a023a9697
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    64993d970dde2a2da353e9e99595a4fa88ec27d9
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46
  - >-
    Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 <
    1fdc4164e488916402badddbb1f51e9380dabb91
  - Linux 4.17
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:13:04.332Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99236'
references:
  - url: 'https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093'
  - url: 'https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72'
  - url: 'https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa'
  - url: 'https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048'
  - url: 'https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b'
  - url: 'https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697'
  - url: 'https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9'
  - url: 'https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46'
  - url: 'https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02302
ingestedAt: '2026-11-05T20:33:06.389Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: Reject incomplete event filter expressions

A non-empty expression normally finishes in predicate_parse()'s inner
loop, which resolves the pending logical operators before jumping to
finalization. If the input ends after an operator, possibly followed by
unary '!' tokens, the outer loop instead falls through with unresolved
operator state.

For example, "common_pid == 1 || common_pid == 2 &&" leaves
prog[0].target equal to -1. The second pass then reads prog[-1] before
the forward-jump check can reject it. Depending on adjacent slab
contents, it can also copy an out-of-bounds word into a branch target
that passes the forward-only check. A self-targeted perf tracepoint
counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.

Reject the outer-loop fallthrough when a predicate has already been
parsed. This ensures that non-empty expressions only reach finalization
after the inner loop has resolved their operators. Keep the existing
no-filter error for input that has no predicates. Add a regression test
for trailing logical operators and unary negations.

## Affected

- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 4a1a6d35359991c5d47f4bf101cfbe1475c94093`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 2a98f5d4913ec081e08e1075512cb7ec313d9f72`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 15ff3cc7f2beecc3f95d66358f20ad7b057466aa`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < b205ff58e02922ac324f931cf9eb238a3acdb048`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 5a999b5a16530898f0dbe5f8c50fd45ea72e110b`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 1008e9e0b8280d47f1ab5e9c113f666a023a9697`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 64993d970dde2a2da353e9e99595a4fa88ec27d9`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46`
- `Linux >= 80765597bc587feae8dbc8ce97a0f32e12a6e625 < 1fdc4164e488916402badddbb1f51e9380dabb91`
- `Linux 4.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.