UBUNTU-CVE-2026-99163: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield(), when a synthetic event field is a stacktrace (field->isstack) and the histogram field is not a "long[" stacktrace array, validation falls through to the generic size and signedness comparison. Because parsesynthfield() sets a stacktrace field's type to "dataloc unsigned long[]", its size is sizeof(u64) and synthfieldsigned() marks it as signed. Consequently, any 8-byte signed scalar histogram field passes the fallback check, and its scalar value is subsequently dereferenced as a kernel stacktrace pointer in getfieldsize() and tracestack(). Furthermore, checking strstr(histfield->type, "long[") is insufficient because tracepoint fields defined with bitmask() or relbitmask() also have type "dataloc unsigned long[]" or "relloc unsigned long[]", whilst createhistfield() treats them as 4-byte scalar values without HISTFIELDFLSTACKTRACE. Propagate HISTFIELDFLSTACKTRACE to variable references and field variables (whilst excluding variable aliases from per-element stacktrace capture), and reject any mismatch between HISTFIELDFLSTACKTRACE and field->isstack in checksynthfield().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the tracing histogram implementation, propagate HIST_FIELD_FL_STACKTRACE to variable references and field variables while excluding variable aliases from per-element stacktrace capture, and update check_synth_field() to reject any mismatch between HIST_FIELD_FL_STACKTRACE and field->is_stack; do not rely solely on strstr(hist_field->type, "long[") because __bitmask() and __rel_bitmask() fields can use __data_loc unsigned long[] or __rel_loc unsigned long[] while remaining 4-byte scalar fields.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-gke, ubuntu/linux, and ubuntu/linux-aws.
What tracing functionality must be involved for this issue to be reachable?
The issue is in tracing histograms and synthetic stacktrace fields. Exploitation requires a synthetic event stacktrace field to be paired with a histogram field that bypasses the intended stacktrace-field validation.
Are fixed package versions or mitigation steps provided?
No fixed package versions, configuration workaround, or temporary mitigation is included in the provided data.