Executive brief
The Linux kernel's ring-buffer tracing feature failed to properly initialize a memory page attribute during buffer allocation. When a ring-buffer uses sub-buffers larger than the system page size, this omission causes incorrect memory deallocation, potentially leading to memory corruption or system instability when the buffer is freed.
Technical details
In the rb_allocate_cpu_buffer() function, the bpage->order field was not initialized, remaining at 0 by default. This is a logic bug affecting ring-buffers with sub-buffer sizes exceeding PAGE_SIZE. The free_buffer_page() function depends on the correct order value to deallocate memory properly. The fix aligns bpage->order with the actual allocation size (buffer::subbuf_order). The vulnerability requires the affected code path to execute during buffer teardown. Attack vector requires local access to trigger ring-buffer operations.
Affected products
- Linux Linux kernel affected versions include 2.6.11 through 7.2 and related stable branches where the ring-buffer feature with sub-buffer allocation is used
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched