---
id: CVE-2026-99163
title: >-
  tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace
  fields
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace
  fields


  In check_synth_field(), when a synthetic event field is a stacktrace

  (field->is_stack)…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 00cf3d672a9dd409418647e9f98784c339c3ff63 <
    1f36e4ddd05d540f363dbaa4c23042549f15b3ef
  - >-
    Linux >= 00cf3d672a9dd409418647e9f98784c339c3ff63 <
    deb336ae7c7b341591a6862cf6fcfeca97c77dfd
  - >-
    Linux >= 00cf3d672a9dd409418647e9f98784c339c3ff63 <
    a244c241593b5b38a08f0df2cb43c26574efbdcb
  - Linux b9453380c1c542fd095a4dbe9251eeba4022bbce
  - Linux 5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55
  - Linux f3baa42afeea0d5f04ad31525e861199d02210cc
  - Linux >= 5.10.237 < 5.11
  - Linux >= 5.15.124 < 5.16
  - Linux >= 6.1.43 < 6.2
  - Linux 6.3
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:15.577Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99163'
references:
  - url: 'https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef'
  - url: 'https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd'
  - url: 'https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.395Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

In check_synth_field(), when a synthetic event field is a stacktrace
(field->is_stack) and the histogram field is not a "long[" stacktrace
array, validation falls through to the generic size and signedness
comparison.

Because parse_synth_field() sets a stacktrace field's type to
"__data_loc unsigned long[]", its size is sizeof(u64) and
synth_field_signed() marks it as signed.  Consequently, any 8-byte
signed scalar histogram field passes the fallback check, and its scalar
value is subsequently dereferenced as a kernel stacktrace pointer in
get_field_size() and trace_stack().

Furthermore, checking strstr(hist_field->type, "long[") is insufficient
because tracepoint fields defined with __bitmask() or __rel_bitmask()
also have type "__data_loc unsigned long[]" or "__rel_loc unsigned
long[]", whilst create_hist_field() treats them as 4-byte scalar values
without HIST_FIELD_FL_STACKTRACE.

Propagate HIST_FIELD_FL_STACKTRACE to variable references and field
variables (whilst excluding variable aliases from per-element
stacktrace capture), and reject any mismatch between
HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().

## Affected

- `Linux >= 00cf3d672a9dd409418647e9f98784c339c3ff63 < 1f36e4ddd05d540f363dbaa4c23042549f15b3ef`
- `Linux >= 00cf3d672a9dd409418647e9f98784c339c3ff63 < deb336ae7c7b341591a6862cf6fcfeca97c77dfd`
- `Linux >= 00cf3d672a9dd409418647e9f98784c339c3ff63 < a244c241593b5b38a08f0df2cb43c26574efbdcb`
- `Linux b9453380c1c542fd095a4dbe9251eeba4022bbce`
- `Linux 5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55`
- `Linux f3baa42afeea0d5f04ad31525e861199d02210cc`
- `Linux >= 5.10.237 < 5.11`
- `Linux >= 5.15.124 < 5.16`
- `Linux >= 6.1.43 < 6.2`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.