CVE-2026-99142

What it actually does

Out-of-bounds write in predicate_parse() when operator stack top reaches the last allocated entry before the push, allowing access beyond the stack buffer in the Linux kernel tracing subsystem.

Why it matters to the business

Kernel instability, potential denial of service, or local privilege escalation affecting systems that use tracing filters or events, increasing risk of downtime or compromise especially on recently published kernel builds.

How an attack unfolds

An attacker supplies a crafted predicate or filter expression to tracing that forces predicate_parse() to evaluate an operator stack entry and perform an unchecked push, writing beyond the allocated buffer.

How to fix it

Apply the upstream fix that adds an explicit capacity check before pushing to the operator stack; rebuild and deploy the patched kernel across all affected distributions.

How to confirm the fix worked

Confirm the presence of the capacity check in predicate_parse() source, run regression tests with edge-case parentheses expressions, and verify no out-of-bounds accesses occur under tracing load.

Typical attack path

1. Identify a system exposing kernel tracing interfaces or allowing unprivileged trace event configuration.
2. Craft a predicate containing opening parentheses that triggers the initial stack entry use followed by additional operators.
3. Trigger the parse path so that top reaches the final allocated slot and the subsequent write overflows.
4. Leverage the resulting memory corruption for kernel code execution or crash.

How to detect it

Review kernel logs for oops or panic messages originating from predicate_parse or tracing predicate handling; inspect audit trails for unusual trace filter creation attempts.

What your security team should do

• Immediately update to the patched kernel version once released by distributions.
• Restrict unprivileged access to tracing configuration until patches are applied.
• Monitor kernel logs for stack-related faults in the tracing subsystem.