CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing: Prevent out-of-bounds read in glob matching

String event fields are not necessarily NUL-terminated, so the filter
predicate functions (filter_pred_string(), filter_pred_strloc() and
filter_pred_strrelloc()) pass the field length to the regex match
callbacks, and the length-aware matchers honour it.

regex_match_glob() was the exception: it ignored the length and called
glob_match(), which scans the string until it hits a NUL byte. Some
string fields are not NUL-terminated. One example is the dynamic char
array of the xfs_* namespace tracepoints, which is copied without a
trailing NUL. For such a field, glob matching reads past the end of
the event field, causing a KASAN slab-out-of-bounds read in
glob_match(), reached via regex_match_glob() and filter_match_preds()
from the xfs_lookup tracepoint.

Add a length-bounded glob_match_len() and use it from regex_match_glob()
so glob matching always stops at the field boundary. The matching loop
is factored into a shared helper so glob_match() keeps its behaviour.

The Linux kernel CVE team has assigned CVE-2026-64299 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 5.10.261 with commit 265f3a690f6c7d69ef7d2ca50b04b4853a211df3
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 5.15.212 with commit ee5b8888d3248618251fb69a2fad92afcb81557e
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.1.178 with commit 56d4c9ab84714eebb285a2fee68aaedf81e3ef15
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.6.145 with commit 35ae19764eabfe9c29029d3b5713c86e6855acdf
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.12.96 with commit ebb55902856973906c8bb339a3a34824ed4a5086
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 6.18.39 with commit 2dad64a97e1df47f5d9ccb17fa319aa348617226
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 7.1.4 with commit e5d5f3bd053a5f14787526c9f0f55ef900d43ac6
	Issue introduced in 4.10 with commit 60f1d5e3bac44b598f67d36062da96c095d2b700 and fixed in 7.2-rc3 with commit 0a6070839b1ef276d5b05bedfb787743e140fb17

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64299
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/glob.h
	kernel/trace/trace_events_filter.c
	lib/glob.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3
	https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e
	https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15
	https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf
	https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086
	https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226
	https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6
	https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17