Quick answers
- Is CVE-2026-99158 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-99158 being exploited in the wild.
- How severe is CVE-2026-99158?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- Linux kernel 5.0 and later (exact range not specified).
- Is there a fix for CVE-2026-99158?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-99158 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-99158?
- Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A race condition in ring_buffer_map_get_reader() causes it to treat a NULL return from rb_get_reader_page() as an error and warn, when the NULL is actually a benign result of the reader catching up with a writer that hasn't yet published committed data. The fix removes the erroneous WARN_ON() macro and instead handles the NULL case gracefully by exiting without warning, as the underlying reader-page helper already validates this condition.
Affected products
- Linux kernel 5.0 and later (exact range not specified)
Timeline
- 2026-10-28: disclosed