{"id":"CVE-2026-64028","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Avoid NULL return from hist_field_name() on truncation\n\nhist_field_name() returns \"\" everywhere except the fully-qualified\nVAR_REF/EXPR case, where snprintf() …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Avoid NULL return from hist_field_name() on truncation\n\nhist_field_name() returns \"\" everywhere except the fully-qualified\nVAR_REF/EXPR case, where snprintf() …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel = 6.6.141","linux_kernel = 6.12.91","linux_kernel = 6.18.33","linux_kernel = 7.0.10","linux_kernel = 7.1"],"published":"2026-07-19","updated":"2026-10-13","sourceUpdated":"2026-10-13T15:23:52.833","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64028","references":[{"url":"https://git.kernel.org/stable/c/0402a1d3ddec565132867337ed44514a09d84728","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37377b39ff86dacbc533275c1155210d4fd5dc91","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/576ec047d20b368b43c4d5db98c4f2e0f3c101ec","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/915c1254fe0788abddc31095b360e9dc98907a34","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be4e99038c1603fa6b329d8ee3e364825e17c353","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d6c8b3ebdcdb12b59ad4212acb137cc56cae453d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3f5d42cdc2f167719564693675f1eead81378ea","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e91687643c440ca3997d67646e6f80b92edc6703","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00231,"epssPercentile":0.12844,"ingestedAt":"2026-10-13T15:33:40.026Z","slug":"CVE-2026-64028","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Avoid NULL return from hist_field_name() on truncation\n\nhist_field_name() returns \"\" everywhere except the fully-qualified\nVAR_REF/EXPR case, where snprintf() truncation returns NULL early\nand bypasses the bottom NULL->\"\" guard. Callers don't expect NULL:\nstrcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758\nand the strcmp() in the sort-key match loop at :4804 both deref it.\n\nsystem and event_name are bounded by MAX_EVENT_NAME_LEN, but the\nfield name on a VAR_REF is kstrdup'd from a histogram variable\nname parsed out of the trigger string and has no length cap, so\na long enough var name in a fully qualified reference can reach\nthe truncation path.\n\nKeep the length check but leave field_name as \"\" on overflow.\n\n## Affected\n\n- `linux_kernel = 6.6.141`\n- `linux_kernel = 6.12.91`\n- `linux_kernel = 6.18.33`\n- `linux_kernel = 7.0.10`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}