In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrelloc()) pass the field length to the regex match callbacks, and the length-aware matchers honour it. regex_match_glob() was the exception: it ignored the length and called glob_match(), which scans the string until it hits a NUL byte. Some string fields are not NUL-terminated. One example is the dynamic char array of the xfs_* namespace tracepoints, which is copied without a trailing NUL. For such a field, glob matching reads past the end of the event field, causing a KASAN slab-out-of-bounds read in glob_match(), reached via regex_match_glob() and filter_match_preds() from the xfs_lookup tracepoint. Add a length-bounded glob_match_len() and use it from regex_match_glob() so glob matching always stops at the fi
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64299 is a memory safety vulnerability in the Linux kernel's event filtering and tracing subsystem. The vulnerability exists in the regex_match_glob() function, which fails to respect string length boundaries when performing glob pattern matching on kernel trace event fields. Unlike other filter predicate functions that properly handle non-NUL-terminated strings by passing field length information, regex_match_glob() ignores this length parameter and calls glob_match() unsafely, allowing it to read beyond allocated buffer boundaries. This affects Linux systems using kernel tracing features, particularly those with unprivileged tracing access enabled, potentially exposing sensitive kernel memory to local attackers or causing denial of service through kernel crashes.
While this CVE currently has zero matching Casky skills due to the absence of mapped MITRE ATT&CK techniques and CWE classification, practitioners using Casky.ai would benefit from monitoring for exploitation patterns through Claude's extended reasoning capabilities. Detection would focus on abnormal kernel trace filter operations, particularly those involving string event field pattern matching with suspicious length parameters. Security teams should watch for evidence of memory disclosure attempts targeting /sys/kernel/debug/tracing interfaces, unusual glob pattern submissions in trace event filters, and kernel panics or information leaks correlated with tracing subsystem activity. As Casky's skill matrix expands to include memory safety and kernel exploitation techniques, practitioners will gain automated detection for unauthorized tracing access patterns and out-of-bounds read exploitation attempts targeting this class of vulnerability.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64299. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation