HIGH Introduced in 7.1
ring-buffer RemoteReader Corruption
CVE-2026-89499
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer. __rb_get_reader_page_from_remote() currently warns about that failure but continues with the unchanged reader ID and rearranges the local page list as though the swap succeeded. Handle the callback failure as a recoverable error. Report it with pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader page as a failed attempt. This avoids splicing the same page as both the previous and new reader without flooding the log under contention.
02KernelScan AI Analysis
Risk summary
A race condition in the kernel's ring-buffer remote reader page swap logic can corrupt the internal page list when the swap callback fails but execution continues as if it succeeded. This results in the same page being spliced into two positions, leading to memory corruption that can crash the kernel or potentially be exploited for arbitrary read/write. The vulnerability requires root or CAP_SYS_ADMIN to set up the ring-buffer remote and is triggered under contention during an event storm on a small buffer.
Vulnerability analysis
The kernel's ring-buffer remote feature allows external entities like firmware or a hypervisor to write tracing events into kernel memory. When a remote page-swap operation fails because the writer advanced the buffer head before the reader kept up, the original code ignored the failure and continued rearranging the local page list using stale data. This causes the same page to be linked into two positions, corrupting the internal list structure. The fix detects the failed swap and aborts the operation, returning an error that callers already handle gracefully. The vulnerable path is reachable only after a privileged user configures a ring-buffer remote, and the race window opens during heavy event traffic on a small buffer.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 7.1 | 7.3-rc1 | 5eab74874d11 |
| 7.2 | 7.1 | 7.2.4 | a14a97048e48 |