Executive brief
The Linux kernel's ring-buffer tracing mechanism contains a logic error when remote reader page swaps fail during high-volume event logging on small buffers. Previously, the code would continue operating with corrupted state despite the failure, potentially causing trace data corruption or denial of service. The fix ensures graceful failure handling to prevent data structure inconsistency.
Technical details
This is a logic error in kernel/trace/ring_buffer.c's __rb_get_reader_page_from_remote() function. When the swap_reader_page callback returns -EBUSY (indicating the writer moved the buffer head before the remote reader could complete the swap), the original code ignored the error and continued rearranging the local page list as if the swap succeeded. This could result in the same page being spliced as both the previous and new reader, corrupting the ring-buffer state. The fix changes the error handling from WARN_ON_ONCE to explicitly check the callback return value, call pr_warn_ratelimited(), and return NULL to signal failure to callers—which already have proper NULL reader page handling. The vulnerability is triggered during event storms on small buffers where writer-reader contention is high. No privilege escalation or remote exploitation is required; any local user with trace access can trigger the condition.
Affected products
- Linux Linux kernel All versions with ring-buffer remote reader support (introduced in commit 2e67fabd8b77)
Timeline
- 2026-09-11: disclosed
- 2026-08-27: patched: Commit 5eab74874d11160725c42ab676ba97a797a362eb merged
- 2026-09-07: other: Backported to stable kernel