UBUNTU-CVE-2026-99143: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse() adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end. Keep nrpreds as the predicate limit and use a separate value for the allocation size. This leaves space for both terminal entries and a zeroed entry when parsing stops at the limit.
Event History
Frequently Asked Questions
What kernel feature is involved in this issue?
The issue is in the Linux kernel tracing subsystem, specifically predicate parsing in predicate_parse().
What condition triggers the out-of-bounds access?
It can occur when the initial predicate count is smaller than the number of predicates actually parsed. The parsed predicates can then fill the allocation, allowing later accesses to go past the end of it.
What is the effect of the fix?
The fix keeps the predicate limit separate from the program allocation size. It reserves space for the terminal TRUE and FALSE entries and for a zeroed entry when parsing stops at the limit.