Type Confusion in Linux kernel - CVE-2026-99163

Vulnerability details

The vulnerability allows a local privileged user to potentially cause a denial of service through an invalid kernel pointer dereference.

The vulnerability exists due to type confusion in check_synth_field() in the Linux kernel tracing histogram subsystem when validating histogram fields for synthetic stacktrace events. A local privileged user can supply an 8-byte signed scalar histogram field that passes size and signedness checks and is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(), potentially causing a kernel fault and denial of service.

Affected software

How to mitigate CVE-2026-99163

External References

• https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef
• https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb
• https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd

Related Security Bulletins

• Type Confusion in Linux kernel trace
• Debian update for linux