Executive brief
The Linux kernel's ring-buffer tracing component contains a race condition when resizing sub-buffers that can lead to memory corruption or system crashes. The ring-buffer is a core kernel component used for event tracing and performance monitoring; a successful exploit could disrupt system stability or enable privilege escalation on vulnerable systems.
Technical details
The vulnerability is a race condition (CWE-362) in the ring_buffer_subbuf_order_set() function in kernel/trace/ring_buffer.c. When resizing ring-buffer sub-buffers, the function clears the cpu_buffer->free_page field without holding the cpu_buffer->lock, creating a window where concurrent calls to ring_buffer_alloc_read_page() or ring_buffer_free_read_page() can access freed or corrupted memory. The fix adds arch_spin_lock/unlock() calls around the free_page manipulation to serialize access. This is a local kernel code path; exploitation requires the ability to trigger ring-buffer resize operations, typically available to root or through tracing interfaces. A patch has been merged into stable kernel branches (commit 24974bd0da1b, backported as 6fcb0b745a0b).
Affected products
- Linux Linux kernel 2.6.11 through 6.12+
Timeline
- 2026-09-11: disclosed
- 2026-08-13: patched: Fix committed upstream as 24974bd0da1b47fd56c975533ead50abf754e74d