CVE-2026-64028

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Avoid NULL return from hist_field_name() on truncation

hist_field_name() returns "" everywhere except the fully-qualified

VAR_REF/EXPR case, where snprintf() truncation returns NULL early

and bypasses the bottom NULL->"" guard. Callers don't expect NULL:

strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758

and the strcmp() in the sort-key match loop at :4804 both deref it.

system and event_name are bounded by MAX_EVENT_NAME_LEN, but the

field name on a VAR_REF is kstrdup'd from a histogram variable

name parsed out of the trigger string and has no length cap, so

a long enough var name in a fully qualified reference can reach

the truncation path.

Keep the length check but leave field_name as "" on overflow.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References