Junglewise Threat Intelligence

CVE-2026-80730: Linux kernel ring-buffer crash on ERR_PTR dereference

CVE-2026-80730 · Severity: info · Published 2026-09-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's ring-buffer self-test has a bug that can crash the system during boot. When kernel thread creation fails, the code attempts to clean up by stopping a thread handle that contains an error pointer rather than a valid thread reference, causing a kernel panic. This affects systems undergoing late initialization tests.

Technical details

The vulnerability is an incorrect pointer check in test_ringbuffer()'s cleanup loop. The code uses `!rb_threads[cpu]` to detect invalid entries, which only catches NULL pointers but misses ERR_PTR values. When kthread_run_on_cpu() fails (returning ERR_PTR(-ENOMEM) or -EINTR), the error pointer is stored in the rb_threads array. During cleanup, the non-NULL ERR_PTR passes the check and is passed to kthread_stop(), which dereferences the invalid pointer. The fix replaces the NULL check with IS_ERR_OR_NULL() macro. No user interaction or special privileges are required; the crash occurs automatically during kernel boot. A patch has been released and applied across multiple Linux kernel versions.

Affected products

  • Linux Linux kernel 7.2.0-rc6 and earlier affected versions

Timeline

  • 2026-09-03: disclosed
  • 2026-08-19: patched: Fix applied to stable kernel branches

References

Related threats