CVE-2026-99236: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99236 is an out-of-bounds memory access vulnerability in the Linux kernel's tracing event filter expression parser that can lead to privilege escalation. The flaw exists in predicate_parse(), where incomplete filter expressions ending with a trailing logical operator (e.g., && or ||) cause the parser to fall through with unresolved operator state, enabling out-of-bounds reads and potential arbitrary kernel memory writes. It affects the Linux kernel from version 4.17 onward, introduced at commit 80765597bc587feae8dbc8ce97a0f32e12a6e625. The vulnerability was published on November 2, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the kernel's tracing filter parser (predicate_parse()). When a filter expression ends after a logical operator — optionally followed by unary ! tokens — the outer parsing loop falls through without resolving pending operator state, leaving prog[0].target set to -1. The subsequent second pass then reads prog[-1] (an out-of-bounds access), and depending on adjacent slab memory contents, may copy an out-of-bounds word into a branch target that passes the forward-only jump check. A local user with access to perf tracing can trigger this via the PERF_EVENT_IOC_SET_FILTER ioctl on a self-targeted perf tracepoint counting event. The fix rejects outer-loop fallthrough when a predicate has already been parsed, ensuring non-empty expressions only reach finalization after the inner loop resolves all operators (GitHub Advisory).

Successful exploitation allows a local user with perf tracing privileges to read out-of-bounds kernel memory (confidentiality impact) and write to arbitrary kernel memory locations (integrity impact), potentially achieving arbitrary code execution with kernel privileges. This constitutes a full privilege escalation to ring-0, enabling an attacker to disable security controls, install rootkits, or pivot to other system resources. Availability is also impacted, as the out-of-bounds access can cause kernel crashes or instability (GitHub Advisory, Feedly).

As of the publication date (November 2, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is reported as 0.0, reflecting low current exploitation probability. Exploitation requires local access and privileges sufficient to use perf tracing events, which limits the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory, Feedly).

1. Gain local access: Obtain a local user account on a vulnerable Linux system (kernel 4.17 or later, unpatched) with permission to use perf events (e.g., CAP_PERFMON or equivalent, or systems where /proc/sys/kernel/perf_event_paranoid allows unprivileged access).
2. Open a perf tracepoint event: Use the perf_event_open() syscall to create a self-targeted perf tracepoint counting event.
3. Craft a malformed filter expression: Construct an event filter string that ends with a trailing logical operator, such as "common_pid == 1 || common_pid == 2 &&", optionally followed by unary ! tokens.
4. Apply the filter via ioctl: Issue PERF_EVENT_IOC_SET_FILTER with the malformed expression on the opened perf event file descriptor to trigger the vulnerable code path in predicate_parse().
5. Trigger out-of-bounds access: The parser falls through with prog[0].target == -1, causing the second pass to read prog[-1] from adjacent slab memory, potentially copying an attacker-influenced value into a branch target.
6. Achieve kernel code execution: Depending on slab layout and kernel version, leverage the arbitrary kernel memory write to overwrite a function pointer or other kernel structure to escalate privileges to root (GitHub Advisory, Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing unexpected slab corruption warnings, general protection faults, or kernel BUG/OOPS traces originating from the tracing subsystem or predicate_parse().
• Process: Unusual processes invoking perf_event_open() syscall followed by ioctl() with PERF_EVENT_IOC_SET_FILTER; processes running as unprivileged users that subsequently gain root or kernel-level capabilities.
• File System: Unexpected modifications to /proc/sys/kernel/perf_event_paranoid lowering restrictions; new setuid binaries or kernel modules appearing after a suspicious perf event session.
• Network: Outbound connections from a previously non-networked process shortly after perf event activity, potentially indicating post-exploitation lateral movement.

Apply the upstream kernel patches that reject incomplete event filter expressions. Fixed versions include: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, and 7.3.1. As an interim workaround, restrict access to perf tracing by setting /proc/sys/kernel/perf_event_paranoid to 3 (or 2 at minimum) to limit perf_event_open() to privileged users only, reducing the attack surface. Upgrading to a patched kernel version is the recommended long-term remediation (GitHub Advisory, Feedly).