Executive brief
The Linux kernel's ring-buffer tracing component contains a race condition where buffer size can be resized while another thread is reading from it without proper synchronization. An attacker with local access could exploit this to cause a kernel crash or potentially read sensitive kernel memory, disrupting system availability or exposing confidential data.
Technical details
The vulnerability is a data race in the ring-buffer subsystem where trace_buffer::subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start() while being concurrently resized via ring_buffer_subbuf_order_set(). The race allows a reader thread to operate on stale size metadata while a resizer thread modifies the buffer structure. The fix involves using the per-page order field instead of the global subbuf_size, and holding the trace_buffer mutex in ring_buffer_read_start() to synchronize with pending buffer modifications. This is a use-after-resize vulnerability affecting the kernel's event tracing infrastructure, accessible to local users.
Affected products
- Linux Linux kernel Affected versions prior to the fix commit 8a5f63637890f03177146efddaba5ec7a1b4d61f
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Upstream fix commit 8a5f63637890f03177146efddaba5ec7a1b4d61f available; backported to stable branches