CVE-2026-64299

A flaw was found in the Linux kernel's tracing subsystem. This vulnerability allows a local attacker to trigger an out-of-bounds read by providing specially crafted input to glob matching functions. The issue arises because these functions did not correctly handle string event fields that were not properly terminated. Successful exploitation could lead to the disclosure of sensitive information or cause a system crash, resulting in a denial of service (DoS).

This vulnerability is rated as Moderate impact because triggering it requires local access to configure trace event filter expressions, constraining the outcome to a localized denial of service or slab memory disclosure. In standard Red Hat Enterprise Linux deployments, access to the kernel tracing facilities is restricted to administrators by default, which substantially limits exposure to unprivileged users. Furthermore, the issue only affects read operations across specific dynamic string event boundaries, preventing arbitrary code execution or data modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.