HIGH Introduced in 6.8
ring-buffer ReadPage Race
CVE-2026-89503
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again. However, what is more problematic is if the value of subbuf_order changes in the middle of ring_buffer_alloc_read_page(). In that case, bpage->order might not match the actual allocated memory. Use bpage->order for the allocation to prevent this race.
02KernelScan AI Analysis
Risk summary
A race condition in the kernel ring-buffer subsystem allows a privileged local attacker to trigger a mismatch between allocated memory size and the recorded buffer order, leading to out-of-bounds memory access. Exploitation requires root or CAP_SYS_ADMIN access to tracing interfaces and winning a narrow timing window. The impact ranges from kernel crash to potential arbitrary memory corruption.
Vulnerability analysis
A race condition exists in the ring buffer reader-page allocation path where the sub-buffer order value can change concurrently while a reader page is being allocated. If the order decreases between the time the page's order field is set and the time memory is allocated, the allocated buffer will be smaller than what the recorded order indicates, causing subsequent reads and writes to access memory beyond the allocation boundary. The fix changes the allocation to use the page's own locally-stored order value rather than re-reading the shared sub-buffer order, ensuring the allocated memory always matches the recorded size. This vulnerability is reachable locally by users with root or CAP_SYS_ADMIN privileges who can access tracing interfaces, and requires concurrent manipulation of the ring buffer's sub-buffer size configuration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.8 | 6.12.112 | 2313ff69bd23 |
| 6.18 | 6.8 | 6.18.50 | 2dc510957fe8 |
| 7.2 | 6.8 | 7.2.4 | 53106e9262a3 |
| mainline | 6.8 | 7.3-rc1 | e743527c5bfd |