Executive brief
A vulnerability in the Linux kernel's tracing subsystem could allow a local user to cause a system crash. The issue occurs when the kernel processes diagnostic data (ring buffers) that may be corrupted or malformed. If exploited, this could lead to an unexpected system shutdown or denial of service, particularly during the system boot process.
Technical details
A vulnerability exists in the Linux kernel's tracing ring-buffer implementation within the rb_read_data_buffer() function. The function failed to validate the length of events before using them to calculate the memory address of the next event. If a ring buffer contains a corrupted or malicious event length, the pointer arithmetic (e + len) can result in an out-of-bounds memory access. This is particularly relevant when validating boot-range memory events where the buffer might be malformed. An attacker with local access could potentially trigger this condition to cause a kernel panic (Denial of Service). Patches have been released for multiple stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.12 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-02-19: patched: Initial patch commit in kernel tree