SB20261029149 - Type Confusion in Linux kernel trace

Description

This security bulletin contains information about 1 vulnerability.

1) Type Confusion (CVE-ID: CVE-2026-99163)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through an invalid kernel pointer dereference.

The vulnerability exists due to type confusion in check_synth_field() in the Linux kernel tracing histogram subsystem when validating histogram fields for synthetic stacktrace events. A local privileged user can supply an 8-byte signed scalar histogram field that passes size and signedness checks and is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(), potentially causing a kernel fault and denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef
• https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb
• https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd