CVE-2026-64028

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the tracing component where the hist field name() function can return a NULL value during truncation in fully-qualified VAR REF/EXPR cases. This occurs because snprintf() truncation returns NULL early, bypassing the guard intended to return an empty string. Since callers do not expect a NULL return, functions such as strcat() and strcmp() may dereference it, potentially leading to a system crash. While system and event name are bounded by MAX EVENT NAME LEN, the field name on a VAR REF is duplicated using kstrdup() from a histogram variable name parsed from a trigger string without a length cap, allowing a sufficiently long variable name to trigger the truncation path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.