HIGH Introduced in 6.8
ring-buffer SubbufOrder Race
CVE-2026-89501
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Because, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, hold cpu_buffer->lock to prevent races with ring_buffer_alloc_read_page() and ring_buffer_free_read_page().
02KernelScan AI Analysis
Risk summary
A race condition in the kernel tracing ring-buffer subsystem can lead to use-after-free or NULL pointer dereference when resizing sub-buffer order concurrently with read-page operations. Both sides of the race require root access to the tracing sysfs interface, limiting the attack to privileged local users. Successful exploitation could corrupt kernel memory, potentially causing a panic or enabling code execution within the kernel.
Vulnerability analysis
When the tracing ring-buffer sub-buffer allocation order is changed, the code clears a cached free page pointer without holding the per-CPU buffer lock. If another thread is simultaneously allocating or freeing a read page through the tracing read interface, it can race on that same pointer, leading to a use-after-free or NULL pointer dereference in kernel memory. The fix acquires the per-CPU buffer lock around the pointer read and clear, ensuring the resize operation is atomic with respect to read-page allocation and free paths. Both the resize and the read-page operations are reached only through the tracing sysfs interface, which requires root or an equivalent capability in the init namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.8 | 6.18.50 | 6fcb0b745a0b |
| 7.2 | 6.8 | 7.2.4 | bf242baf58de |
| mainline | 6.8 | 7.3-rc1 | 24974bd0da1b |
| 6.12 | 6.8 | 6.12.109 | 8a496aaa3da6 |
| cip/6.12 | 6.8 | 6.12.111-cip32 | 8a496aaa3da6 |