{"id":"CVE-2026-99163","revision":"f277641965aa4e45815393c076253d53","records":[{"revision":"f277641965aa4e45815393c076253d53","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99163","aliases":[],"title":"tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field->is_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\n\nBecause parse_synth_field() sets a stacktrace field's type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed.  Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\n\nFurthermore, checking strstr(hist_field->type, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\n\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().","state":0,"publishedAt":"2026-10-28T10:35:15.577+00:00","modifiedAt":"2026-10-30T12:42:29.139+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b9453380c1c542fd095a4dbe9251eeba4022bbce\",\n                            \"lessThan\": \"eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55\",\n                            \"lessThan\": \"326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f3baa42afeea0d5f04ad31525e861199d02210cc\",\n                            \"lessThan\": \"6c4e4946febb585d2fc93a02a0cd12cec715bb32\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00cf3d672a9dd409418647e9f98784c339c3ff63\",\n                            \"lessThan\": \"7e0d05a6234a984ac23b8a563fb7f66f2572b668\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00cf3d672a9dd409418647e9f98784c339c3ff63\",\n                            \"lessThan\": \"648687f2b448d8527cd7b112fe5d4bd0fec85a87\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00cf3d672a9dd409418647e9f98784c339c3ff63\",\n                            \"lessThan\": \"1f36e4ddd05d540f363dbaa4c23042549f15b3ef\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00cf3d672a9dd409418647e9f98784c339c3ff63\",\n                            \"lessThan\": \"deb336ae7c7b341591a6862cf6fcfeca97c77dfd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"00cf3d672a9dd409418647e9f98784c339c3ff63\",\n                            \"lessThan\": \"a244c241593b5b38a08f0df2cb43c26574efbdcb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.237\",\n                            \"lessThan\": \"5.10.273\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.124\",\n                            \"lessThan\": \"5.15.224\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.43\",\n                            \"lessThan\": \"6.1.191\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/trace/trace_events_hist.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.273\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.224\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5","https://git.kernel.org/stable/c/326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be","https://git.kernel.org/stable/c/6c4e4946febb585d2fc93a02a0cd12cec715bb32","https://git.kernel.org/stable/c/7e0d05a6234a984ac23b8a563fb7f66f2572b668","https://git.kernel.org/stable/c/648687f2b448d8527cd7b112fe5d4bd0fec85a87","https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef","https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd","https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99163","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99163","identifiers":["CVE-2026-99163"]},"retained":false,"historicalAffected":[]}],"coverage":[]}