{"id":"CVE-2026-99163","kind":"vulnerability","aliases":["CVE-2026-99163"],"related":[],"title":"Linux kernel: tracing histograms let a scalar be read as a stack pointer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field->is_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\n\nBecause parse_synth_field() sets a stacktrace field's type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed.  Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\n\nFurthermore, checking strstr(hist_field->type, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\n\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().","summary":"The Linux kernel's tracing histogram code accepts an 8-byte signed scalar field where a synthetic stacktrace field is expected, so the scalar is dereferenced as a kernel stacktrace pointer. The sources do not say what an attacker gets beyond that, and the advisory text here gives no privilege or auth details.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","other","self-hosted","tracing"],"not_affected_if":["kernel-tracing-disabled"],"how_to_check":"- `uname -r` to see the running kernel version\n- unknown: the sources do not list affected or fixed kernel versions","fix":"- Update to a kernel release that includes the upstream fix for this tracing/histograms change\n- unknown: the sources do not name the fixed version","status":"open","published_at":"2026-10-28T11:17:36+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:45+00:00","updated_at":"2026-10-28T11:35:45+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-28T11:35:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes the upstream fix for this tracing/histograms change\n- unknown: the sources do not name the fixed version","reach":"local","title":"Linux kernel: tracing histograms let a scalar be read as a stack pointer","impact":"medium","summary":"The Linux kernel's tracing histogram code accepts an 8-byte signed scalar field where a synthetic stacktrace field is expected, so the scalar is dereferenced as a kernel stacktrace pointer. The sources do not say what an attacker gets beyond that, and the advisory text here gives no privilege or auth details.","category":"other","nicknames":[],"who_cares":["linux-kernel","tracing","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: kernel memory read or crash suspected, sources silent","analyst_note":"Find the NVD entry's CVSS and affected kernel version ranges, and the upstream stable commit that carries the fix.","how_to_check":"- `uname -r` to see the running kernel version\n- unknown: the sources do not list affected or fixed kernel versions","needs_analyst":true,"not_affected_if":["kernel-tracing-disabled"],"who_is_affected":"Systems running a Linux kernel with tracing histograms and synthetic events in use, where a user or tool can configure histograms on synthetic stacktrace fields. The sources do not say which kernel versions or configurations are exposed, or whether ordinary unprivileged users can reach the path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000653,"input_tokens":3724,"output_tokens":561,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99163':16A,19A '4':232C '8':37B,166C 'accept':35B 'advisori':72B 'alias':255C 'also':213C 'array':125C 'attack':66B 'auth':79B 'beyond':68B 'bitmask':209C,212C 'byte':38B,167C,233C 'captur':261C 'check':102C,175C,196C,276C 'code':34B 'comparison':135C 'consequ':164C 'creat':226C 'cve':14A,17A 'data':147C,216C 'defin':207C 'dereferenc':53B,182C 'detail':80B 'element':259C 'event':108C 'exclud':253C 'expect':48B 'fall':127C 'fallback':174C 'field':41B,46B,96C,100C,104C,109C,113C,119C,139C,143C,158C,171C,190C,199C,206C,228C,238C,243C,250C,268C,272C,278C 'fl':239C,244C,269C 'follow':86C 'furthermor':195C 'generic':131C 'get':67B,189C 'give':75B 'hist':198C,227C,237C,242C,267C 'histogram':4A,33B,118C,170C 'host':26B 'insuffici':203C 'kernel':2A,22B,30B,56B,84C,185C 'let':5A 'linux':1A,21B,29B,83C 'linux-kernel':20B 'loc':148C,217C,222C 'long':123C,150C,201C,219C,224C 'mark':160C 'mismatch':265C 'non':94C 'non-stacktrac':93C 'pars':137C 'pass':172C 'per':258C 'per-el':257C 'pointer':13A,58B,187C 'privileg':77B 'propag':241C 'read':9A 'refer':248C 'reject':92C,263C 'rel':211C,221C 'resolv':90C 'say':63B 'scalar':7A,40B,51B,169C,178C,234C 'self':25B 'self-host':24B 'set':140C 'sign':39B,159C,163C,168C 'signed':134C 'size':132C,152C,191C 'sizeof':154C 'sourc':60B 'stack':12A,115C,194C,274C 'stacktrac':45B,57B,95C,99C,112C,124C,142C,186C,240C,245C,260C,270C 'strstr':197C 'subsequ':181C 'synth':103C,138C,157C,277C 'synthet':44B,98C,107C 'text':73B 'trace':3A,27B,32B,193C 'tracepoint':205C 'tracing/histograms':91C 'treat':229C 'type':145C,200C,215C 'u64':155C 'unsign':149C,218C,223C 'valid':126C 'valu':179C,235C 'variabl':247C,251C,254C 'vulner':87C 'whilst':225C,252C 'without':236C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with tracing histograms and synthetic events in use, where a user or tool can configure histograms on synthetic stacktrace fields. The sources do not say which kernel versions or configurations are exposed, or whether ordinary unprivileged users can reach the path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99163","severity":null,"published_at":"2026-10-28T11:17:36+00:00","modified_at":"2026-10-28T11:17:36+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}