CVE-2026-74391tracing: Bound synthetic-field strings with seq_buf
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq_buf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The current code appends those strings with raw strcat(), so long key lists, field names, or saved filters can run past the end of the staging buffers. Build both strings with seq_buf and propagate -E2BIG if either the synthetic variable name or the generated command exceeds MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while using the helper intended for bounded command construction. [ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 02205a6752f223779a1b0e9e8ffacbea6e717851 builds before 0c584c27f6649a93ec12061cc779a4bd8f7c1434; 02205a6752f223779a1b0e9e8ffacbea6e717851 builds before 88b901fdc1662b131ff908cbd017333b61e7acc8; from 02205a6752f223779a1b0e9e8ffacbea6e717851 before baa333b2700a7fa3529d504529c8c10060fd687c; from 02205a6752f223779a1b0e9e8ffacbea6e717851 before cf334620036ad2250e008c7e7bb6646a3938b7b0; from 02205a6752f223779a1b0e9e8ffacbea6e717851 before f07883450eb14d1cf020b55d9f3a7ec5683bcd26 | CNA record |
References
- https://git.kernel.org/stable/c/0c584c27f6649a93ec12061cc779a4bd8f7c1434
- https://git.kernel.org/stable/c/88b901fdc1662b131ff908cbd017333b61e7acc8
- https://git.kernel.org/stable/c/baa333b2700a7fa3529d504529c8c10060fd687c
- https://git.kernel.org/stable/c/cf334620036ad2250e008c7e7bb6646a3938b7b0
- https://git.kernel.org/stable/c/f07883450eb14d1cf020b55d9f3a7ec5683bcd26
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.