CVE-2026-64028: tracing: Avoid NULL return from hist_field_name() on truncation
In the Linux kernel, the following vulnerability has been resolved:
tracing: Avoid NULL return from histfieldname() on truncation
histfieldname() returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL: strcat(expr, histfieldname(field, 0)) at traceeventshist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it.
system and eventname are bounded by MAXEVENTNAMELEN, but the field name on a VARREF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path.
Keep the length check but leave fieldname as "" on overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In hist_field_name(), retain the length check and leave field_name as an empty string ("") when snprintf() truncation or overflow occurs, rather than returning NULL.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64028?
The severity of CVE-2026-64028 is classified as risk level 37.
How do I fix CVE-2026-64028?
To fix CVE-2026-64028, update to the patched version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-64028?
CVE-2026-64028 affects the Linux kernel across various distributions and versions.
What is the impact of CVE-2026-64028?
The impact of CVE-2026-64028 relates to potential NULL pointer dereferences leading to application crashes during tracing.
Is CVE-2026-64028 a remote vulnerability?
CVE-2026-64028 is not classified as a remote vulnerability, as it primarily affects local operations within the kernel.