CVE-2026-99143

What it actually does

predicate_parse() miscalculates buffer allocation size versus predicate limit, allowing subsequent memory accesses to exceed the allocated region and cause out-of-bounds reads or writes.

Why it matters to the business

Kernel instability, crashes, or potential local privilege escalation on systems using tracing, increasing downtime and security exposure for any Linux workloads relying on ftrace or related subsystems.

How an attack unfolds

An attacker supplies a crafted set of predicates that exceeds the original nr_preds count; the function allocates based on the smaller value yet continues writing terminal entries, overflowing the buffer and enabling memory corruption that may be leveraged for code execution or denial of service.

How to fix it

Apply the upstream fix that separates nr_preds limit from allocation size; rebuild and deploy updated kernel packages containing the corrected predicate_parse logic.

How to confirm the fix worked

Inspect kernel source for predicate_parse() to confirm nr_preds remains the predicate count limit while allocation size accounts for terminal entries plus a zeroed sentinel; boot test patched kernel under tracing workloads.

Typical attack path

1. Obtain local access or capability to load trace programs on target kernel
2. Invoke tracing interface to reach predicate_parse() with excess predicates
3. Trigger allocation under-count followed by writes past buffer end
4. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs for oops or panic messages referencing predicate_parse or tracing buffer overruns; correlate with processes invoking tracefs or ftrace operations.

What your security team should do

• Immediately update all Linux systems to kernels containing the predicate_parse fix
• Restrict unprivileged use of tracing interfaces until patches are applied
• Monitor vendor advisories for distribution-specific kernel updates