-

CVE-2026-74391

tracing: Bound synthetic-field strings with seq_buf

In the Linux kernel, the following vulnerability has been resolved:

tracing: Bound synthetic-field strings with seq_buf

The synthetic field helpers build a prefixed synthetic variable name and
a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The
current code appends those strings with raw strcat(), so long key lists,
field names, or saved filters can run past the end of the staging
buffers.

Build both strings with seq_buf and propagate -E2BIG if either the
synthetic variable name or the generated command exceeds
MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while
using the helper intended for bounded command construction.

[ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 02205a6752f223779a1b0e9e8ffacbea6e717851
Version < 0c584c27f6649a93ec12061cc779a4bd8f7c1434
Status affected
Version 02205a6752f223779a1b0e9e8ffacbea6e717851
Version < 88b901fdc1662b131ff908cbd017333b61e7acc8
Status affected
Version 02205a6752f223779a1b0e9e8ffacbea6e717851
Version < baa333b2700a7fa3529d504529c8c10060fd687c
Status affected
Version 02205a6752f223779a1b0e9e8ffacbea6e717851
Version < cf334620036ad2250e008c7e7bb6646a3938b7b0
Status affected
Version 02205a6752f223779a1b0e9e8ffacbea6e717851
Version < f07883450eb14d1cf020b55d9f3a7ec5683bcd26
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.17
Status affected
Version 0
Version < 4.17
Status unaffected
Version <= 6.6.*
Version 6.6.145
Status unaffected
Version <= 6.12.*
Version 6.12.97
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.065
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/0c584c27f6649a93ec12061cc779a4bd8f7c1434
https://git.kernel.org/stable/c/88b901fdc1662b131ff908cbd017333b61e7acc8
https://git.kernel.org/stable/c/baa333b2700a7fa3529d504529c8c10060fd687c
https://git.kernel.org/stable/c/cf334620036ad2250e008c7e7bb6646a3938b7b0
https://git.kernel.org/stable/c/f07883450eb14d1cf020b55d9f3a7ec5683bcd26