CVE-2026-99163

Status: UPDATED  |  Advisory ID: CVE-2026-99163

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

In check_synth_field(), when a synthetic event field is a stacktrace

(field->is_stack) and the histogram field is not a "long[" stacktrace

array, validation falls through to the generic size and signedness

comparison.

Because parse_synth_field() sets a stacktrace field's type to

"__data_loc unsigned long[]", its size is sizeof(u64) and

synth_field_signed() marks it as signed. Consequently, any 8-byte

signed scalar histogram field passes the fallback check, and its scalar

value is subsequently dereferenced as a kernel stacktrace pointer in

get_field_size() and trace_stack().

Furthermore, checking strstr(hist_field->type, "long[") is insufficient

because tracepoint fields defined with __bitmask() or __rel_bitmask()

also have type "__data_loc unsigned long[]" or "__rel_loc unsigned

long[]", whilst create_hist_field() treats them as 4-byte scalar values

without HIST_FIELD_FL_STACKTRACE.

Propagate HIST_FIELD_FL_STACKTRACE to variable references and field

variables (whilst excluding variable aliases from per-element

stacktrace capture), and reject any mismatch between

HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References