HIGH Introduced in 6.8
ring-buffer FreePage Race
CVE-2026-89500
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order for the free_pages() call. This mismatched order may crashes the kernel or leaks memory because the cached page was allocated under the old size. Save the actual free_page order alongside the page address to ensure we always refer to the correct value and do not rely on the potentially stalled cpu_buffer->subbuf_order value. The simplest is to make free_page a buffer_data_read_page which already covers exactly what we need: a page address and a page order.
02KernelScan AI Analysis
Risk summary
A race condition in the kernel tracing ring buffer can cause pages to be freed with the wrong allocation order when a buffer resize happens concurrently with reader page operations. This can crash the kernel or corrupt memory. Exploitation requires root-level access to tracing control files and winning a timing window between resize and reader operations.
Vulnerability analysis
When the tracing ring buffer is resized at the same time as reader pages are being cached or discarded, the cached page may be freed using the new allocation order instead of the order under which it was originally allocated. Calling the page allocator with a mismatched order can corrupt the buddy allocator and crash the kernel, or leak memory. The fix stores the actual allocation order alongside the cached page address so the correct order is always used when the page is freed, regardless of any concurrent resize. This path is reachable only by a privileged local user with root or CAP_SYS_ADMIN who can write to tracing control files and trigger the resize, and exploitation requires winning a race between the resize and reader page operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.8 | 6.12.112 | d8f52dc3c3f1 |
| 6.18 | 6.8 | 6.18.51 | a1dabe68fb53 |
| 7.2 | 6.8 | 7.2.4 | d787d509bdf6 |
| mainline | 6.8 | 7.3-rc1 | 7a1fb95de540 |