{"apiVersion":"1.0","identifier":"CVE-2026-99236","description":"In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()-s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary -!- tokens, the outer loop instead falls through with unresolved operator state. For example, -common_pid == 1 || common_pid == 2 &&- leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.","publishedAt":"2026-11-02T16:17:49","lastModifiedAt":"2026-11-03T20:18:29","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99236","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00126,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99236","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99236","en":"https://www.redsauce.net/en/cves/CVE-2026-99236","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99236","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99236","de":"https://www.redsauce.net/de/cves/CVE-2026-99236","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99236","el":"https://www.redsauce.net/el/cves/CVE-2026-99236"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99236"}}