GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89748 (GCVE-0-2026-89748)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-13 06:33
VLAI
Title
tracing: Fix retry exhaustion in simple ring buffer reader swap
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. The current !retry test reverses both outcomes. It returns an error after a successful final replacement, leaving the link update complete but the reader bookkeeping unfinished. After a failed final replacement, it falls through and updates the head and reader pointers as though the replacement succeeded, which can corrupt the ring. Treat only a negative counter as exhaustion and return the documented -EBUSY error.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 34e5b958bdad0f9cf16306368bbc2dc5b2a50143 , < df02489aa3aa1834659f0d20c89f7d212047d268 (git)
Affected: 34e5b958bdad0f9cf16306368bbc2dc5b2a50143 , < e0d3aed7b12cf37b74c7cc5265073d0263b49cde (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/simple_ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df02489aa3aa1834659f0d20c89f7d212047d268",
              "status": "affected",
              "version": "34e5b958bdad0f9cf16306368bbc2dc5b2a50143",
              "versionType": "git"
            },
            {
              "lessThan": "e0d3aed7b12cf37b74c7cc5265073d0263b49cde",
              "status": "affected",
              "version": "34e5b958bdad0f9cf16306368bbc2dc5b2a50143",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/simple_ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix retry exhaustion in simple ring buffer reader swap\n\nsimple_ring_buffer_swap_reader_page() starts with retry set to 8 and\npost-decrements it only after a failed link replacement. On the final\nattempt, a successful replacement leaves retry at zero, while a failed\nreplacement leaves it at -1.\n\nThe current !retry test reverses both outcomes. It returns an error after\na successful final replacement, leaving the link update complete but the\nreader bookkeeping unfinished. After a failed final replacement, it\nfalls through and updates the head and reader pointers as though the\nreplacement succeeded, which can corrupt the ring.\n\nTreat only a negative counter as exhaustion and return the documented\n-EBUSY error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local tracefs reads of remotes/*/trace_pipe or remotes/*/trace, which call ring_buffer_consume/peek -\u003e __rb_get_reader_page_from_remote() -\u003e swap_reader_page() into simple_ring_buffer_swap_reader_page() (ARM64 nVHE hyp tracing or the TRACE_REMOTE_TEST module). No network, adjacent-radio, or physical path exists.\nAC:L - An attacker with tracefs access shrinks remotes/*/buffer_size_kb, enables tracing, and storms events via remotes/*/write_event or KVM hyp events while reading trace_pipe. That drives the writer to move the head across the eight cmpxchg retries; the attacker controls both sides and can retry until inverted exhaustion hits.\nPR:L - remotes/ files are mode 0440/0640 and use custom fops with no capable() or tracing_check_open_get_tr() check, only DAC. tracing-gid mounts on Android eng/Perfetto, ChromeOS, and developer kernels grant this to unprivileged tracing-group users, matching CVE-2026-89499 and prior CNA tracefs scores.\nUI:N - The attacker opens, configures, and reads their own remotes/*/trace_pipe and related tracefs files. No separate victim mount, click, or other user action is required.\nS:U - Corruption is of host kernel ring-buffer buffer_page lists and simple_ring_buffer metadata in the same OS security authority. A host-local tracefs user cannot use this as a VM, IOMMU, or guest-to-host escape.\nC:H - Inverted retry exhaustion leaves the reader page in the writer ring (success reported as error) or makes the host adopt a live writer page as reader (failure reported as success). Concurrent commits tear event headers so rb_event_length() returns unbounded sizes, and later peeks follow corrupted buffer_page pointers, enabling out-of-bounds kernel reads.\nI:H - After a failed final cmpxchg the function still updates head_page, reader_page, link.prev, and meta.reader.id, and the host splices buffer_page lists as if the swap succeeded. That kernel list-metadata corruption is exploitable for arbitrary writes and control-flow hijack, matching sibling remote-swap CVE-2026-89499.\nA:H - The inverted path hits WARN_ON_ONCE(prev_reader == new_reader) on the host, can infinite-spin in simple_rb_find_head() on SIMPLE_RB_LINK_HEAD_MOVING, and oopses on corrupted page pointers. panic_on_warn turns those WARNs into panics, and the attacker can retrigger the path at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:33:57.730Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde"
        }
      ],
      "title": "tracing: Fix retry exhaustion in simple ring buffer reader swap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89748",
    "datePublished": "2026-09-11T19:46:53.070Z",
    "dateReserved": "2026-09-11T19:38:34.762Z",
    "dateUpdated": "2026-09-13T06:33:57.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89748",
      "date": "2026-09-16",
      "epss": "0.00154",
      "percentile": "0.04897"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89748\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:05.643\",\"lastModified\":\"2026-09-13T07:17:39.493\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: Fix retry exhaustion in simple ring buffer reader swap\\n\\nsimple_ring_buffer_swap_reader_page() starts with retry set to 8 and\\npost-decrements it only after a failed link replacement. On the final\\nattempt, a successful replacement leaves retry at zero, while a failed\\nreplacement leaves it at -1.\\n\\nThe current !retry test reverses both outcomes. It returns an error after\\na successful final replacement, leaving the link update complete but the\\nreader bookkeeping unfinished. After a failed final replacement, it\\nfalls through and updates the head and reader pointers as though the\\nreplacement succeeded, which can corrupt the ring.\\n\\nTreat only a negative counter as exhaustion and return the documented\\n-EBUSY error.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/simple_ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"34e5b958bdad0f9cf16306368bbc2dc5b2a50143\",\"lessThan\":\"df02489aa3aa1834659f0d20c89f7d212047d268\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34e5b958bdad0f9cf16306368bbc2dc5b2a50143\",\"lessThan\":\"e0d3aed7b12cf37b74c7cc5265073d0263b49cde\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/simple_ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:52:39+00:00",
      "cve": "CVE-2026-89748",
      "id": "CVE-2026-89748",
      "initial_release_date": "2026-09-11T19:46:53.070000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Ring buffer corruption in tracing due to retry exhaustion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89748.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:56:28Z",
      "cve": "CVE-2026-89748",
      "id": "CVE-2026-89748",
      "initial_release_date": "2026-09-12T16:22:18Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89748",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89748.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.