Linux kernel: Improper validation in tracing histograms for synthetic stacktrace fields
Summary
The Linux kernel tracing histogram code does not properly validate histogram fields used with synthetic stacktrace fields. An 8-byte signed scalar histogram field can pass the check and be treated as a kernel stacktrace pointer, which can lead to kernel memory corruption. An attacker needs a local account with low privileges and access to the tracing interface.
Affected
- Linux kernel versions from 5.10.237 to before 5.10.273, 5.15.124 to before 5.15.224, and 6.1.43 to before 6.1.191 (per CNA record)
- Mainline and other stable branches with the affected commits, as listed in the CNA record (affected from 6.3 per CNA ranges, default affected)
- Distribution kernels: Unknown.
Fixed in
- Linux stable kernels 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13 (per CNA record and OSV)
- Distribution kernel fixed builds: Unknown.
Workaround
- No vendor workaround known.
- Restrict access to tracefs/debugfs to root (general hardening, not vendor-documented).
Exploitation
- Not known to be exploited.
- No public proof of concept known. Not listed in CISA KEV.
Our recommendation
- Apply the kernel update from your distribution as part of the normal patch cycle and reboot when required.
- Until patched, restrict tracefs/debugfs access to root and review local accounts on multi-user hosts.
- Raise the priority for shared Linux hosts or systems with untrusted local users; monitor for unexpected kernel crashes.
- Verify the fixed build for your distribution in its security tracker, as the version data is not yet confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 1f36e4dd git.kernel.org
- Linux kernel stable commit 326c45c9 git.kernel.org
- Linux kernel stable commit eba0a636 git.kernel.org
- OSV entry BELL-CVE-2026-99163 osv.dev
- Ubuntu security tracker CVE-2026-99163 ubuntu.com
- Debian CVE tracker via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:01.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field is not a "long[" stacktrace array, validation falls through to the generic size and signedness comparison. Because parse_synth_field() sets a stacktrace field's type to "__data_loc unsigned long[]", its size is sizeof(u64) and synth_field_signed() marks it as signed. Consequently, any 8-byte signed scalar histogram field passes the fallback check, and its scalar value is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(). Furthermore, checking strstr(hist_field->type, "long[") is insufficient because tracepoint fields defined with __bitmask() or __rel_bitmask() also have type "__data_loc unsigned long[]" or "__rel_loc unsigned long[]", whilst create_hist_field() treats them as 4-byte scalar values without HIST_FIELD_FL_STACKTRACE. Propagate HIST_FIELD_FL_STACKTRACE to variable references and field variables (whilst excluding variable aliases from per-element stacktrace capture), and reject any mismatch between HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().
NVD references (8)
- https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef
- https://git.kernel.org/stable/c/326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be
- https://git.kernel.org/stable/c/648687f2b448d8527cd7b112fe5d4bd0fec85a87
- https://git.kernel.org/stable/c/6c4e4946febb585d2fc93a02a0cd12cec715bb32
- https://git.kernel.org/stable/c/7e0d05a6234a984ac23b8a563fb7f66f2572b668
- https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb
- https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd
- https://git.kernel.org/stable/c/eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.