Executive brief
The Linux kernel's tracing subsystem contains a use-after-free vulnerability in the trace_pipe mechanism when the ring buffer sub-buffer size is changed. An attacker with write access to buffer_subbuf_size_kb can trigger the reallocation of ring buffer pages while readers are actively dereferencing them, causing a kernel crash or potentially allowing code execution. This affects the core tracing infrastructure used for kernel event monitoring and debugging.
Technical details
The vulnerability is a use-after-free race condition in the kernel's ring buffer implementation. When ring_buffer_subbuf_order_set() is called (triggered by writing to buffer_subbuf_size_kb in sysfs), it frees all sub-buffer pages including the reader page and reallocates them. However, ring_buffer_peek() returns an event pointer after releasing the cpu_buffer->reader_lock, and subsequent calls to ring_buffer_event_length() and ring_buffer_event_data() dereference that pointer without holding a lock. If the sub-buffer order is changed during this window, the reader dereferences already-freed memory. The fix acquires trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change, preventing races since trace_pipe readers already hold this lock across their entire peek-and-print loop. A patch has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions; fix included in stable series
Timeline
- 2026-09-11: disclosed: CVE-2026-89747 published
- 2026-08-22: patched: Patch merged upstream by Steven Rostedt
- 2026-09-07: advisory: Stable kernel patch by Greg Kroah-Hartman