Executive brief
The Linux kernel's tracing subsystem contains a logic error in its simple ring buffer implementation that can corrupt trace data or fail to record traces properly. A flawed retry counter check causes the function to either reject valid operations or proceed with failed operations, potentially leading to data loss or system instability in tracing infrastructure.
Technical details
The vulnerability is a logic error in the simple_ring_buffer_swap_reader_page() function in kernel/trace/simple_ring_buffer.c. The function uses a retry counter starting at 8 and post-decrements it only on failed atomic swap operations. The bug exists in the condition checking retry exhaustion: the original code tests `if (!retry)` which treats both successful completion (retry == 0) and exhaustion (retry == -1) identically. This causes the function to incorrectly reject successful final attempts while allowing corrupted states after failed attempts. The fix changes the condition to `if (retry < 0)` to properly distinguish exhaustion. Without this fix, either trace bookkeeping remains incomplete after successful swaps, or the ring buffer state becomes corrupted after failed swaps. The vulnerability affects any kernel with the simple_ring_buffer feature enabled.
Affected products
- Linux Linux kernel Versions containing simple_ring_buffer (introduced in commit 34e5b958bdad onwards)
Timeline
- 2026-09-11: disclosed
- 2026-08-27: patched: Upstream fix commit e0d3aed7b12cf37b74c7cc5265073d0263b49cde
- 2026-09-07: patched: Stable backport commit df02489aa3aa1834659f0d20c89f7d212047d268