Executive brief
The Linux kernel's ring-buffer tracing component can be corrupted when buffer resize operations and tracer configuration changes occur concurrently, leading to system crashes (kernel panic/oops). This affects systems relying on kernel tracing for diagnostics and monitoring, and can result in unexpected service outages or system instability.
Technical details
The vulnerability is a race condition in the ring-buffer implementation where ring_buffer_swap_cpu is called during a resize operation, causing the CPU buffer to be swapped in an inconsistent state. This occurs in kernel/trace/ring_buffer.c and can be reliably reproduced by running concurrent buffer resizing and tracer state changes. The attack vector is local with no special privileges required beyond the ability to write to /sys/kernel/debug/tracing entries (typically available to root or members of the tracing group). An attacker can trigger NULL pointer dereferences and kernel warnings leading to denial of service through kernel crashes. The fix prevents buffer swapping during ongoing resize operations to maintain state consistency.
Affected products
- Linux Linux kernel through 6.5
Timeline
- 2025-10-22: disclosed