Cloudanix VulnDB

CVE-2026-99163

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's event tracking tools could let someone with system access crash the machine or damage memory by creating certain kinds of diagnostic records.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits a scalar 8-byte histogram field to bypass stacktrace validation in check_synth_field, causing its value to be dereferenced as a kernel stacktrace pointer inside get_field_size and trace_stack, resulting in invalid memory access or corruption.

Why it matters to the business

Systems using kernel tracing for diagnostics or observability face elevated risk of crashes or memory corruption; recent disclosure requires rapid patching to maintain stability across Linux fleets.

How an attack unfolds

An attacker with local access to the tracing subsystem creates a synthetic event containing a stacktrace field paired with a non-stacktrace histogram source; the missing HIST_FIELD_FL_STACKTRACE propagation allows the scalar to reach pointer-dereference paths when the histogram is processed.

How to fix it

Upgrade the Linux kernel to a version containing the corrected check_synth_field logic that enforces HIST_FIELD_FL_STACKTRACE consistency for synthetic stacktrace fields; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm the patch by inspecting the updated check_synth_field and create_hist_field functions for explicit stacktrace flag propagation and mismatch rejection; test with synthetic event creation using mixed stacktrace and scalar fields to verify rejection.

Typical attack path

  1. Obtain local access to a Linux system with tracing enabled
  2. Use tracefs or perf to define a synthetic event with a stacktrace field
  3. Attach a histogram using an 8-byte signed scalar field instead of a long[] stacktrace array
  4. Trigger histogram collection or variable reference to invoke get_field_size and trace_stack
  5. Induce kernel memory corruption or oops from the invalid pointer dereference

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing tracing, histograms, synth_field, get_field_size, or trace_stack; audit tracefs writes for synthetic event definitions that mix stacktrace and scalar fields.

What your security team should do

  • Prioritize kernel updates on all production systems within the next maintenance window
  • Temporarily restrict unprivileged access to tracefs and perf_event_open where tracing is not required
  • Review custom tracing scripts and synthetic event definitions for stacktrace usage
  • Include kernel oops monitoring in existing alerting for tracing-related crashes

The record

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field is not a "long[" stacktrace array, validation falls through to the generic size and signedness comparison. Because parse_synth_field() sets a stacktrace field's type to "__data_loc unsigned long[]", its size is sizeof(u64) and synth_field_signed() marks it as signed. Consequently, any 8-byte signed scalar histogram field passes the fallback check, and its scalar value is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(). Furthermore, checking strstr(hist_field->type, "long[") is insufficient because tracepoint fields defined with __bitmask() or __rel_bitmask() also have type "__data_loc unsigned long[]" or "__rel_loc unsigned long[]", whilst create_hist_field() treats them as 4-byte scalar values without HIST_FIELD_FL_STACKTRACE. Propagate HIST_FIELD_FL_STACKTRACE to variable references and field variables (whilst excluding variable aliases from per-element stacktrace capture), and reject any mismatch between HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().

Affected packages

Ecosystem Package Introduced Fixed