CVE-2026-74391

Summary

In the Linux kernel, the following vulnerability has been resolved:

tracing: Bound synthetic-field strings with seq_buf

The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The current code appends those strings with raw strcat(), so long key lists, field names, or saved filters can run past the end of the staging buffers.

Build both strings with seq_buf and propagate -E2BIG if either the synthetic variable name or the generated command exceeds MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while using the helper intended for bounded command construction.

[ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]

Affected Software

VendorProductVersion RangeStatus
LinuxLinux02205a6752f223779a1b0e9e8ffacbea6e717851 < 0c584c27f6649a93ec12061cc779a4bd8f7c1434affected
LinuxLinux02205a6752f223779a1b0e9e8ffacbea6e717851 < 88b901fdc1662b131ff908cbd017333b61e7acc8affected
LinuxLinux02205a6752f223779a1b0e9e8ffacbea6e717851 < baa333b2700a7fa3529d504529c8c10060fd687caffected
LinuxLinux02205a6752f223779a1b0e9e8ffacbea6e717851 < cf334620036ad2250e008c7e7bb6646a3938b7b0affected
LinuxLinux02205a6752f223779a1b0e9e8ffacbea6e717851 < f07883450eb14d1cf020b55d9f3a7ec5683bcd26affected
LinuxLinux4.17affected
LinuxLinux0 < 4.17unaffected
LinuxLinux6.6.145 <= 6.6.*unaffected
LinuxLinux6.12.97 <= 6.12.*unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2-rc1 <= *unaffected

Weaknesses

References