CVE-2026-99236

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Reject incomplete event filter expressions<br /> <br /> A non-empty expression normally finishes in predicate_parse()&amp;#39;s inner<br /> loop, which resolves the pending logical operators before jumping to<br /> finalization. If the input ends after an operator, possibly followed by<br /> unary &amp;#39;!&amp;#39; tokens, the outer loop instead falls through with unresolved<br /> operator state.<br /> <br /> For example, "common_pid == 1 || common_pid == 2 &amp;&amp;" leaves<br /> prog[0].target equal to -1. The second pass then reads prog[-1] before<br /> the forward-jump check can reject it. Depending on adjacent slab<br /> contents, it can also copy an out-of-bounds word into a branch target<br /> that passes the forward-only check. A self-targeted perf tracepoint<br /> counting event can reach this path through PERF_EVENT_IOC_SET_FILTER.<br /> <br /> Reject the outer-loop fallthrough when a predicate has already been<br /> parsed. This ensures that non-empty expressions only reach finalization<br /> after the inner loop has resolved their operators. Keep the existing<br /> no-filter error for input that has no predicates. Add a regression test<br /> for trailing logical operators and unary negations.