HIGH Introduced in 7.1
tracing RingBuffer Corruption
CVE-2026-89748
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. The current !retry test reverses both outcomes. It returns an error after a successful final replacement, leaving the link update complete but the reader bookkeeping unfinished. After a failed final replacement, it falls through and updates the head and reader pointers as though the replacement succeeded, which can corrupt the ring. Treat only a negative counter as exhaustion and return the documented -EBUSY error.
02KernelScan AI Analysis
Risk summary
A logic error in the simple ring buffer reader swap can corrupt the ring buffer's internal pointers when retry exhaustion is misdetected. Local users with access to tracing functionality could trigger this to cause data corruption or denial of service.
Vulnerability analysis
The simple ring buffer reader swap function misinterprets the retry counter after the final attempt, returning an error after a successful link replacement (leaving bookkeeping incomplete) or proceeding to update head and reader pointers after a failed replacement (corrupting the ring buffer). The fix changes the exhaustion check from a zero test to a negative test, correctly distinguishing between a successful final attempt and actual retry exhaustion. This is reachable locally by users who can interact with the tracing subsystem's ring buffer.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.4 | df02489aa3aa |
| mainline | 7.1 | 7.3-rc1 | e0d3aed7b12c |