HIGH Introduced in 6.8
tracing SubbufOrder UAF
CVE-2026-89747
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of trace_pipe hold pointers into those pages. ring_buffer_peek() looks up an event under cpu_buffer->reader_lock but returns the event pointer after dropping the lock, and peek_next_entry() then calls ring_buffer_event_length() and ring_buffer_event_data() on it. If the sub-buffer order is changed in that window, the reader dereferences freed memory: BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 Freed by: free_buffer_page kernel/trace/ring_buffer.c:398 [inline] ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221 Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change. This is the lock trace_pipe readers already hold across their entire peek-and-print loop, so the swap can no longer race with a reader that is dereferencing a peeked event.
02KernelScan AI Analysis
Risk summary
A local attacker with privileges to write to tracefs (typically root) can trigger a use-after-free by concurrently reading trace_pipe and changing the ring buffer sub-buffer order. The race window allows dereferencing freed ring buffer pages, potentially leading to kernel memory corruption, information disclosure, or a system crash.
Vulnerability analysis
Reconfiguring the tracing ring buffer size through the debug filesystem frees and replaces all buffer pages. A concurrent reader of the trace pipe may still be referencing an event in one of those pages, so the replacement frees memory that is still in use. The fix synchronizes the page swap with active readers by holding the same access lock that readers use across their entire read, closing the race window. An attacker needs local privileges to write to the tracing debug filesystem, normally root access, and must win a narrow timing race between the size change and a concurrent read.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.8 | 6.12.109 | 05ebe1e1d7d3 |
| 6.18 | 6.8 | 6.18.50 | ddbe921ed16a |
| 7.2 | 6.8 | 7.2.4 | 7a49d19ff9ba |
| mainline | 6.8 | 7.3-rc1 | 372f8534244d |
| cip/6.12 | 6.8 | 6.12.111-cip32 | 05ebe1e1d7d3 |