Executive brief
The Linux kernel's ring-buffer tracing subsystem incorrectly calculates event data lengths on architectures with forced 8-byte memory alignment (such as RISC-V). This causes trace logging utilities to report padding bytes as actual data, producing misleading debug output. While this is primarily a diagnostic issue affecting kernel tracing and debugging tools, it could complicate troubleshooting of system behavior and lead to incorrect performance analysis.
Technical details
This is a logic error in the ring-buffer event length calculation in the Linux kernel's tracing subsystem. When RB_FORCE_8BYTE_ALIGNMENT is enabled, rb_calculate_event_length() reserves space in event->array[0] for a data length field, but ring_buffer_event_length() only subtracts this field size for events larger than RB_MAX_SMALL_DATA. For small events on architectures with 64-bit aligned access (detected via CONFIG_HAVE_64BIT_ALIGNED_ACCESS), the function reports 4 bytes larger than actual payload, causing ftrace and other kernel tracing tools to display incorrect data field sizes. The vulnerability requires kernel debugging/tracing to be active and affects only diagnostic output, not system security or stability. A fix adds RB_FORCE_8BYTE_ALIGNMENT as a condition to unconditionally subtract the alignment field size.
Affected products
- Linux Linux kernel affected versions with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y
Timeline
- 2026-09-04: disclosed