---
id: "CVE-2026-99163"
kind: "vulnerability"
aliases: ["CVE-2026-99163"]
title: "Linux kernel: tracing histograms let a scalar be read as a stack pointer"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["linux-kernel", "other", "self-hosted", "tracing"]
not_affected_if: ["kernel-tracing-disabled"]
published_at: "2026-10-28T11:17:36+00:00"
first_seen_at: "2026-10-28T11:32:36+00:00"
updated_at: "2026-10-28T11:35:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99163", "first_seen_at": "2026-10-28T11:32:36+00:00"}]
---

# Linux kernel: tracing histograms let a scalar be read as a stack pointer

The Linux kernel's tracing histogram code accepts an 8-byte signed scalar field where a synthetic stacktrace field is expected, so the scalar is dereferenced as a kernel stacktrace pointer. The sources do not say what an attacker gets beyond that, and the advisory text here gives no privilege or auth details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- unknown: the sources do not list affected or fixed kernel versions

## Fix

- Update to a kernel release that includes the upstream fix for this tracing/histograms change
- unknown: the sources do not name the fixed version

## Timeline

- 2026-10-28T11:32:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99163

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

In check_synth_field(), when a synthetic event field is a stacktrace
(field->is_stack) and the histogram field is not a "long[" stacktrace
array, validation falls through to the generic size and signedness
comparison.

Because parse_synth_field() sets a stacktrace field's type to
"__data_loc unsigned long[]", its size is sizeof(u64) and
synth_field_signed() marks it as signed.  Consequently, any 8-byte
signed scalar histogram field passes the fallback check, and its scalar
value is subsequently dereferenced as a kernel stacktrace pointer in
get_field_size() and trace_stack().

Furthermore, checking strstr(hist_field->type, "long[") is insufficient
because tracepoint fields defined with __bitmask() or __rel_bitmask()
also have type "__data_loc unsigned long[]" or "__rel_loc unsigned
long[]", whilst create_hist_field() treats them as 4-byte scalar values
without HIST_FIELD_FL_STACKTRACE.

Propagate HIST_FIELD_FL_STACKTRACE to variable references and field
variables (whilst excluding variable aliases from per-element
stacktrace capture), and reject any mismatch between
HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_