Executive brief
The Linux kernel's ring-buffer tracing component contains a race condition in the ring_buffer_alloc_read_page() function that can cause memory allocation mismatches when the buffer size is being resized. If the subbuf_order value changes during page allocation, the allocated memory size may not match the buffer's metadata, potentially leading to out-of-bounds memory access or kernel instability.
Technical details
This is a time-of-check-time-of-use (TOCTOU) race condition in the kernel's ring-buffer tracing infrastructure. The vulnerable code in ring_buffer_alloc_read_page() reads the global subbuf_order value at the time of allocation, but if ring_buffer_subbuf_order_set() is called concurrently, the allocated page's actual memory size may not match the bpage->order metadata structure. The attack vector is local (requires kernel code execution context), and the fix involves reading bpage->order (which is captured at the start of the function) rather than the potentially-changed cpu_buffer->buffer->subbuf_order during the actual allocation call. The patch is already available in upstream Linux and stable trees.
Affected products
- Linux Linux kernel Multiple versions (fix available in stable and upstream)
Timeline
- 2026-09-11: disclosed: CVE-2026-89503 published
- 2026-09-07: patched: Fix merged to stable kernel trees by Greg Kroah-Hartman
- 2026-08-13: other: Patch authored by Vincent Donnefort