Executive brief
The Linux kernel's ring buffer tracing mechanism contains a memory management bug that occurs when the buffer size is changed while a cached read page is in use. An attacker or faulty application could trigger concurrent buffer resizing to cause kernel crashes or memory leaks, potentially leading to denial of service or exposing sensitive kernel memory to unprivileged users.
Technical details
This vulnerability exists in the kernel's ring buffer tracing infrastructure (kernel/trace/ring_buffer.c). When a ring buffer is resized concurrently with the caching of a read page, the kernel incorrectly uses the new global subbuf_order value to free a page that was allocated under the old buffer size. This mismatch in page order causes either kernel crashes or memory leaks. The fix stores the actual page allocation order alongside the page address by changing the cpu_buffer::free_page field from a simple pointer to a buffer_data_read_page structure that contains both the page address and its original allocation order. The vulnerability requires ability to trigger ring buffer resize operations, which may be restricted to privileged users depending on kernel configuration.
Affected products
- Linux Linux kernel various; patched in commit 7a1fb95de5404134f8758c1295ce88986bdf117c
Timeline
- 2026-09-11: disclosed: CVE-2026-89500 published
- 2026-08-14: patched: Fix committed upstream as 7a1fb95de5404134f8758c1295ce88986bdf117c
- 2026-09-09: other: Fix backported to stable kernel branches