Not yet scoredPublished Aug 15, 2026

CVE-2026-74391tracing: Bound synthetic-field strings with seq_buf

Updated under an hour ago (Oct 28, 2026, 12:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seq_buf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAX_FILTER_STR_VAL buffers. The current code appends those strings with raw strcat(), so long key lists, field names, or saved filters can run past the end of the staging buffers. Build both strings with seq_buf and propagate -E2BIG if either the synthetic variable name or the generated command exceeds MAX_FILTER_STR_VAL. This keeps the existing tracing-side limit while using the helper intended for bounded command construction. [ sdr: Moved struct seq_buf *s for upside-down x-mas tree formatting ]

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	02205a6752f223779a1b0e9e8ffacbea6e717851 builds before 0c584c27f6649a93ec12061cc779a4bd8f7c1434; 02205a6752f223779a1b0e9e8ffacbea6e717851 builds before 88b901fdc1662b131ff908cbd017333b61e7acc8; from 02205a6752f223779a1b0e9e8ffacbea6e717851 before baa333b2700a7fa3529d504529c8c10060fd687c; from 02205a6752f223779a1b0e9e8ffacbea6e717851 before cf334620036ad2250e008c7e7bb6646a3938b7b0; from 02205a6752f223779a1b0e9e8ffacbea6e717851 before f07883450eb14d1cf020b55d9f3a7ec5683bcd26	CNA record

References

References

https://git.kernel.org/stable/c/0c584c27f6649a93ec12061cc779a4bd8f7c1434
https://git.kernel.org/stable/c/88b901fdc1662b131ff908cbd017333b61e7acc8
https://git.kernel.org/stable/c/baa333b2700a7fa3529d504529c8c10060fd687c
https://git.kernel.org/stable/c/cf334620036ad2250e008c7e7bb6646a3938b7b0
https://git.kernel.org/stable/c/f07883450eb14d1cf020b55d9f3a7ec5683bcd26

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.