Executive brief
The Linux kernel's ring-buffer tracing component contains a use-after-free vulnerability when changing the sub-buffer order while resizing is disabled. An attacker or malicious application with access to tracing subsystem could exploit this to read or write arbitrary kernel memory, potentially leading to privilege escalation or system crash.
Technical details
The vulnerability is a use-after-free condition in the ring_buffer_subbuf_order_set() function in kernel/trace/ring_buffer.c. The function frees buffer pages, but the code path did not check if resizing was disabled—a condition that indicates a non-consuming reader is actively using the buffer. When resizing is disabled and subbuf order is changed, the reader can still reference freed memory via rb_advance_iter(), leading to use-after-free. The fix adds a check for atomic_read(&cpu_buffer->resize_disabled) and returns -EBUSY if resizing is disabled, matching the behavior of ring_buffer_resize(). The vulnerability was discovered via syzbot fuzzing and affects the Linux kernel tracing infrastructure.
Affected products
- Linux Linux kernel multiple versions (see stable branches 2.6.11.y through 7.2.y and mainline)
Timeline
- 2026-08-22: disclosed: CVE-2026-74634 published
- 2026-08-19: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-08-06: other: Fix developed by Vincent Donnefort