Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0013 2.4 —
AFFECTED Product Versions Fixed Linux 2e8578364061c4e88ae33bc20c2d6f64f365f6a2 – — Linux 6.6.141 – —
TIMELINE Jul 19 Reserved by Linux Jul 19 Published (CNA: Linux) Oct 13 ENRICHED — CVE-2026-64028 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist_field_name() on truncation hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->"" guard. Callers don't expect NULL: strcat(expr, hist_field_name(field, 0)) at trace_events_hist.c:1758 and the strcmp() in the sort-key match loop at :4804 both deref it. system and event_name are bounded by MAX_EVENT_NAME_LEN, but the field name on a VAR_REF is kstrdup'd from a histogram variable name parsed out of the trigger string and has no length cap, so a long enough var name in a fully qualified reference can reach the truncation path. Keep the length check but leave field_name as "" on overflow.
| Date | Event | Detail |
|---|---|---|
| July 19, 2026 | Reserved | Reserved by Linux |
| July 19, 2026 | Published | Published (CNA: Linux) |
| October 13, 2026 | ENRICHED | ENRICHED — CVE-2026-64028 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-64028 at cve.org
Vendors: linux
Weaknesses: CWE-476
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64028 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
