Executive brief
The Linux kernel's ring-buffer tracing component has a memory management bug where CPU buffer pages are freed with incorrect parameters when using larger buffer sizes. This could lead to memory leaks or heap corruption that may cause system instability or crash.
Technical details
The vulnerability is a memory management bug in the ring-buffer tracing subsystem (kernel/trace/ring_buffer.c). When sub-buffers are allocated with an order greater than 0, the cpu_buffer->free_page is allocated using that subbuf_order, but during cleanup the code was calling free_page() with a hardcoded order instead of using the correct subbuf_order parameter. This results in deallocation of incorrect memory sizes. The fix changes the deallocation from free_page() to free_pages() with the correct subbuf_order. The vulnerability affects the kernel's internal tracing infrastructure and requires no network access or user interaction.
Affected products
- Linux Linux kernel affected versions include multiple stable series from 2.6.x through 7.x
Timeline
- 2026-09-11: disclosed
- 2026-08-14: patched