CVE-2026-64028 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing: Avoid NULL return from hist_field_name() on truncation
hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL: strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it.
system and event_name are bounded by MAX_EVENT_NAME_LEN, but the field name on a VAR_REF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path.
Keep the length check but leave field_name as "" on overflow.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's tracing subsystem where the hist_field_name() function fails to properly handle buffer truncation scenarios during string operations. The issue manifests when processing fully-qualified variable references in histogram expressions, specifically when snprintf() encounters truncation conditions that cause it to return NULL instead of the expected truncated string. This NULL return bypasses the standard NULL-to-empty-string conversion guard that typically protects against such scenarios, creating a critical inconsistency in the function's behavior.
The technical flaw stems from the difference in how the function handles various field reference types. While hist_field_name() normally returns empty strings for most cases, it behaves differently during fully-qualified VAR_REF/EXPR processing where snprintf() truncation leads to an early NULL return. This divergence creates a dangerous inconsistency because callers of this function expect consistent string behavior regardless of the field type being processed. The specific locations of vulnerability include trace_events_hist.c line 1758 where strcat() operations occur and line 4804 where strcmp() operations process these values, both of which assume valid string pointers rather than NULL values.
The operational impact of this vulnerability extends beyond simple functional failures to potential security implications within the kernel's tracing infrastructure. When a malicious actor can craft a sufficiently long variable name in a histogram trigger string, they can force the system into an undefined state where NULL pointers are dereferenced during string concatenation and comparison operations. This creates opportunities for denial of service conditions that could destabilize the entire kernel tracing subsystem, potentially affecting other kernel components that rely on consistent behavior from these functions.
The vulnerability demonstrates a classic buffer management issue that aligns with CWE-121 and CWE-787, representing heap-based buffer overflow conditions where insufficient bounds checking leads to memory corruption scenarios. From an attack surface perspective, this vulnerability maps to ATT&CK technique T1059.006 for command and scripting interpreter execution through kernel-level tracing manipulation, as well as T1566.001 for malicious command injection via kernel interfaces. The fix implemented addresses the root cause by maintaining proper length checks while ensuring that field_name remains as empty string even when overflow occurs, thereby preserving consistent function behavior across all execution paths.
The resolution specifically targets the truncation path in hist_field_name() by modifying the handling logic to maintain an empty string return rather than allowing NULL propagation. This approach ensures that downstream operations like strcat() and strcmp() receive predictable string inputs, eliminating the possibility of NULL pointer dereferences while maintaining backward compatibility with existing kernel tracing functionality. The fix also reinforces proper input validation practices that align with secure coding guidelines for kernel development environments, particularly concerning string handling and buffer management in kernel-space operations that directly impact system stability and security posture.
This vulnerability highlights the importance of consistent error handling within kernel subsystems where multiple code paths must maintain predictable behavior for security-critical operations. The fix demonstrates proper defensive programming practices by ensuring that even in edge cases involving buffer truncation, the function maintains its expected interface contract, preventing potential exploitation scenarios while preserving the intended functionality of the tracing infrastructure.