NULL pointer dereference in Linux kernel - CVE-2026-64028
Published: July 20, 2026
Vulnerability identifier: #VU138624
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64028
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of truncation-induced null return values in hist_field_name() in kernel/trace/trace_events_hist.c when processing a fully qualified histogram variable reference with an overly long variable name. A local user can supply a crafted trigger string to cause a denial of service.
The issue occurs because callers dereference the returned value without expecting NULL.
Affected software
Linux kernel
How to mitigate CVE-2026-64028
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0402a1d3ddec565132867337ed44514a09d84728
- https://git.kernel.org/stable/c/37377b39ff86dacbc533275c1155210d4fd5dc91
- https://git.kernel.org/stable/c/576ec047d20b368b43c4d5db98c4f2e0f3c101ec
- https://git.kernel.org/stable/c/915c1254fe0788abddc31095b360e9dc98907a34
- https://git.kernel.org/stable/c/be4e99038c1603fa6b329d8ee3e364825e17c353
- https://git.kernel.org/stable/c/d6c8b3ebdcdb12b59ad4212acb137cc56cae453d
- https://git.kernel.org/stable/c/e3f5d42cdc2f167719564693675f1eead81378ea
- https://git.kernel.org/stable/c/e91687643c440ca3997d67646e6f80b92edc6703