Executive brief
The Linux kernel's ring-buffer module contains a race condition that allows an interrupt to swap CPU buffers while a write operation is still in progress. This can corrupt buffer state, trigger kernel warnings, and potentially lead to data loss or system instability in high-performance monitoring and logging systems that depend on reliable per-CPU buffering.
Technical details
The vulnerability exists in the ring_buffer_swap_cpu() function, which uses a per-CPU committing counter to determine if a buffer is actively being written to. However, the committing counter can temporarily drop to zero during a single write operation within rb_move_tail(), creating a race window where an interrupt can successfully perform a swap even though the write is incomplete. This leads to inconsistent buffer state and triggers RB_WARN_ON warnings in rb_commit(). The fix replaces the committing counter check with current_context checks that remain valid throughout the entire write operation. The vulnerability requires local interrupt access and affects the kernel's ring-buffer tracing infrastructure.
Affected products
- Linux Linux kernel <unknown>
Timeline
- 2026-08-22: disclosed