CVE-2026-74391
In the Linux kernel, the following vulnerability has been resolved:
tracing: Bound synthetic-field strings with seq_buf
The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The current code appends those strings with raw strcat(), so long key lists, field names, or saved filters can run past the end of the staging buffers.
Build both strings with seq_buf and propagate -E2BIG if either the synthetic variable name or the generated command exceeds MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while using the helper intended for bounded command construction.
Leer descripción completaMostrar menos
[ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/0c584c27f6649a93ec12061cc779a4bd8f7c1434
- https://git.kernel.org/stable/c/88b901fdc1662b131ff908cbd017333b61e7acc8
- https://git.kernel.org/stable/c/baa333b2700a7fa3529d504529c8c10060fd687c
- https://git.kernel.org/stable/c/cf334620036ad2250e008c7e7bb6646a3938b7b0
- https://git.kernel.org/stable/c/f07883450eb14d1cf020b55d9f3a7ec5683bcd26
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74391",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "0c584c27f6649a93ec12061cc779a4bd8f7c1434",
"versionType": "git"
},
{
"status": "affected",
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "88b901fdc1662b131ff908cbd017333b61e7acc8",
"versionType": "git"
},
{
"status": "affected",
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "baa333b2700a7fa3529d504529c8c10060fd687c",
"versionType": "git"
},
{
"status": "affected",
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "cf334620036ad2250e008c7e7bb6646a3938b7b0",
"versionType": "git"
},
{
"status": "affected",
"version": "02205a6752f223779a1b0e9e8ffacbea6e717851",
"lessThan": "f07883450eb14d1cf020b55d9f3a7ec5683bcd26",
"versionType": "git"
}
],
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-15T06:22:41.067",
"references": [
{
"url": "https://git.kernel.org/stable/c/0c584c27f6649a93ec12061cc779a4bd8f7c1434",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88b901fdc1662b131ff908cbd017333b61e7acc8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/baa333b2700a7fa3529d504529c8c10060fd687c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cf334620036ad2250e008c7e7bb6646a3938b7b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f07883450eb14d1cf020b55d9f3a7ec5683bcd26",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Bound synthetic-field strings with seq_buf\n\nThe synthetic field helpers build a prefixed synthetic variable name and\na generated hist command in fixed MAX_FILTER_STR_VAL buffers. The\ncurrent code appends those strings with raw strcat(), so long key lists,\nfield names, or saved filters can run past the end of the staging\nbuffers.\n\nBuild both strings with seq_buf and propagate -E2BIG if either the\nsynthetic variable name or the generated command exceeds\nMAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while\nusing the helper intended for bounded command construction.\n\n[ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]"
}
],
"lastModified": "2026-08-17T06:19:34.167",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}