CVE-2026-74391
Description
AI Translation Available
In the Linux kernel, the following vulnerability has been resolved:
tracing: Bound synthetic-field strings with seq_buf
The synthetic field helpers build a prefixed synthetic variable name and
a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The
current code appends those strings with raw strcat(), so long key lists,
field names, or saved filters can run past the end of the staging
buffers.
Build both strings with seq_buf and propagate -E2BIG if either the
synthetic variable name or the generated command exceeds
MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while
using the helper intended for bounded command construction.
[ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]
https://git.kernel.org/stable/c/0c584c27f6649a93ec12061cc779a4bd8f7c1434
https://git.kernel.org/stable/c/88b901fdc1662b131ff908cbd017333b61e7acc8
https://git.kernel.org/stable/c/baa333b2700a7fa3529d504529c8c10060fd687c
https://git.kernel.org/stable/c/cf334620036ad2250e008c7e7bb6646a3938b7b0
https://git.kernel.org/stable/c/f07883450eb14d1cf020b55d9f3a7ec5683bcd26