CVE-2026-74391

A flaw was found in the tracing subsystem of the Linux kernel. This vulnerability occurs because synthetic field helpers use unbounded string concatenation (strcat()) when building synthetic variable names and generated history commands. An attacker providing excessively long input for key lists, field names, or saved filters could cause a buffer overflow. This could lead to a denial of service (DoS) or other unpredictable system behavior.

Tracing synthetic field helpers build synthetic variable names and generated hist commands in fixed MAX_FILTER_STR_VAL heap buffers. The old code used raw strcat on attacker influenced field names, key lists, and saved filters, so an overlong configuration can write past the end of the staging buffer in kernel memory. This is a local tracefs control plane issue rather than a packet or remote network path. In typical deployments only administrators can configure hist triggers through tracefs. For the CVSS the PR:L is used for the paranoid score because some systems may delegate tracing access to non root users, service accounts, or container root with tracing related capabilities. Impact is at least denial of service via kernel memory corruption and may include privilege escalation if the heap overflow can be shaped reliably.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.