GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89771 (GCVE-0-2026-89771)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:47 – Updated: 2026-09-13 06:34
VLAI
Title
ring-buffer: Fix subbuf resize race with ring buffer readers
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). Instead of trace_buffer::subbuf_size, use bpage::order in ring_buffer_read_start() and ring_buffer_read_page(). In ring_buffer_read_start(), even with resize_disabled, there is still a possibility of a race with a buffer modification. Hold the trace_buffer mutex to synchronise with any pending ring buffer order modification. trace_buffer::subbuf_size is now actually useless, remove it. Also, create accessors rb_subbuf_capacity() and rb_page_capacity() which return the actual size available for storing events, while rb_subbuf_size() returns the actual subbuf page-size.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 6d666f0b8b36c0765cf19fbe6de5a7ba5a73aad9 (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 50f4a793c4ff24826efb0ac700989a5063cc53df (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 0c7c517827a453128a8f58bfd849546a29813b27 (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 8a5f63637890f03177146efddaba5ec7a1b4d61f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d666f0b8b36c0765cf19fbe6de5a7ba5a73aad9",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "50f4a793c4ff24826efb0ac700989a5063cc53df",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "0c7c517827a453128a8f58bfd849546a29813b27",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "8a5f63637890f03177146efddaba5ec7a1b4d61f",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix subbuf resize race with ring buffer readers\n\ntrace_buffer subbuf_size is read lockless in ring_buffer_read_page() and\nring_buffer_read_start(), while it can simultaneously be resized with\nring_buffer_subbuf_order_set().\n\nInstead of trace_buffer::subbuf_size, use bpage::order in\nring_buffer_read_start() and ring_buffer_read_page().\n\nIn ring_buffer_read_start(), even with resize_disabled, there is still a\npossibility of a race with a buffer modification. Hold the trace_buffer\nmutex to synchronise with any pending ring buffer order modification.\n\ntrace_buffer::subbuf_size is now actually useless, remove it. Also,\ncreate accessors rb_subbuf_capacity() and rb_page_capacity() which\nreturn the actual size available for storing events, while\nrb_subbuf_size() returns the actual subbuf page-size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local tracefs: write() to buffer_subbuf_size_kb (ring_buffer_subbuf_order_set) racing with read()/splice() of per_cpu/*/trace_pipe_raw (ring_buffer_read_page) or open/read of trace (ring_buffer_read_start). No network, adjacent-radio, or physical path exists.\nAC:L - The attacker controls both sides: one thread writes buffer_subbuf_size_kb while another reads trace_pipe_raw or trace. ring_buffer_subbuf_order_set publishes the new subbuf_size before allocating replacement pages and without reader_lock, so the window includes synchronize_rcu() plus GFP_KERNEL allocation and is reliably retried.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check. buffer_subbuf_size_kb is 0640 and trace_pipe_raw/trace are 0440/0640, routinely delegated via tracefs gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems, matching CVE-2024-50207 and CVE-2026-74634.\nUI:N - Exploitation uses the attacker\u0027s own tracefs file descriptors and threads (write buffer_subbuf_size_kb while reading trace_pipe_raw or trace). No separate victim mount, click, or configuration action is required.\nS:U - The out-of-bounds memset/memcpy corrupt kernel ring-buffer pages and adjacent heap within the same OS security authority. This enables local privilege escalation but does not cross VM, IOMMU, container, or hardware trust boundaries.\nC:H - ring_buffer_read_page() uses the lockless new subbuf_size to memset/memcpy past an old-order spare or reader page, and tracing_buffers_read copy_to_user of that oversized length discloses adjacent kernel heap to userspace. The same OOB corruption is also a high-impact read primitive.\nI:H - After a passing order check, ring_buffer_read_page() memset()s (new_subbuf_size-size) bytes past the still-old data page (up to hundreds of KB when order jumps 0 to 7). That kernel heap OOB write is exploitable for arbitrary writes and control-flow hijack, not merely a crash.\nA:H - The same OOB memset/memcpy corrupt adjacent kernel objects and ring-buffer metadata, producing oops/panic. The attacker chooses the order delta via buffer_subbuf_size_kb and can retrigger the race at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:34:12.518Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d666f0b8b36c0765cf19fbe6de5a7ba5a73aad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/50f4a793c4ff24826efb0ac700989a5063cc53df"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c7c517827a453128a8f58bfd849546a29813b27"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a5f63637890f03177146efddaba5ec7a1b4d61f"
        }
      ],
      "title": "ring-buffer: Fix subbuf resize race with ring buffer readers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89771",
    "datePublished": "2026-09-11T19:47:10.381Z",
    "dateReserved": "2026-09-11T19:38:34.765Z",
    "dateUpdated": "2026-09-13T06:34:12.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89771",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02058"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89771\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:08.460\",\"lastModified\":\"2026-09-13T07:17:41.310\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Fix subbuf resize race with ring buffer readers\\n\\ntrace_buffer subbuf_size is read lockless in ring_buffer_read_page() and\\nring_buffer_read_start(), while it can simultaneously be resized with\\nring_buffer_subbuf_order_set().\\n\\nInstead of trace_buffer::subbuf_size, use bpage::order in\\nring_buffer_read_start() and ring_buffer_read_page().\\n\\nIn ring_buffer_read_start(), even with resize_disabled, there is still a\\npossibility of a race with a buffer modification. Hold the trace_buffer\\nmutex to synchronise with any pending ring buffer order modification.\\n\\ntrace_buffer::subbuf_size is now actually useless, remove it. Also,\\ncreate accessors rb_subbuf_capacity() and rb_page_capacity() which\\nreturn the actual size available for storing events, while\\nrb_subbuf_size() returns the actual subbuf page-size.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"6d666f0b8b36c0765cf19fbe6de5a7ba5a73aad9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"50f4a793c4ff24826efb0ac700989a5063cc53df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"0c7c517827a453128a8f58bfd849546a29813b27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"8a5f63637890f03177146efddaba5ec7a1b4d61f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c7c517827a453128a8f58bfd849546a29813b27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/50f4a793c4ff24826efb0ac700989a5063cc53df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d666f0b8b36c0765cf19fbe6de5a7ba5a73aad9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8a5f63637890f03177146efddaba5ec7a1b4d61f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T19:23:24+00:00",
      "cve": "CVE-2026-89771",
      "id": "CVE-2026-89771",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ring-buffer: Fix subbuf resize race with ring buffer readers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89771.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:56:13Z",
      "cve": "CVE-2026-89771",
      "id": "CVE-2026-89771",
      "initial_release_date": "2026-09-12T16:21:44Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89771",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89771.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.