CVE-2026-121995: Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail
A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffer.
Other sources
Stack buffer overflow in parsetracepointdefinition (gdb/tracepoint.c), Z branch. The packet buffer rs->buf is reused between requests without clearing. When a short qTsP reply follows a longer qTfP reply, the parser's p pointer — advanced through strchr/unpackvarlenhex calls — walks past the short reply's NUL terminator into stale data from the prior longer reply. hex2bin then copies strlen(p)/2 pairs into an alloca buffer sized only for the short reply, overflowing it. Fires automatically during target remote connection setup with no additional user commands.
— Red Hat