An attacker can trigger an out-of-bounds read within the Linux kernel’s tracing subsystem. The flaw lies in the glob_match function, which ignores the supplied string length and continues scanning until it finds a null byte. Because certain trace event data, such as the dynamic character arrays in the xfs_* namespace, are not null‑terminated, glob matching can read past the allocated buffer. This leads to a KASAN slab‑out‑of‑bounds read that may expose sensitive kernel memory or cause a crash. The weakness is identified by CWE-125.

All upstream Linux kernel releases that include the vulnerable tracing code are affected, regardless of architecture. Distributions that have not yet applied the patch commit (0a6070839b1ef276d5b05bedfb787743e140fb17) are at risk. Affected version information is not available, so any system running a kernel version without this commit is considered vulnerable until its patch is confirmed. The vulnerability is confined to the kernel; user‑space applications are not directly impacted unless they interact with the tracepoints that trigger the flaw.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest a very low likelihood of existing exploitation. However, the bug requires local or privileged kernel access to trigger the vulnerable trace path, so an attacker must already possess sufficient access. If successful, the out‑of‑bounds read could leak confidential kernel data or destabilise the system. The impact remains significant, warranting prompt remediation.