Linux kernel ring-buffer subbuf resize race flaw
CVE-2026-89771 Published on September 11, 2026
ring-buffer: Fix subbuf resize race with ring buffer readers
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix subbuf resize race with ring buffer readers
trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and
ring_buffer_read_start(), while it can simultaneously be resized with
ring_buffer_subbuf_order_set().
Instead of trace_buffer::subbuf_size, use bpage::order in
ring_buffer_read_start() and ring_buffer_read_page().
In ring_buffer_read_start(), even with resize_disabled, there is still a
possibility of a race with a buffer modification. Hold the trace_buffer
mutex to synchronise with any pending ring buffer order modification.
trace_buffer::subbuf_size is now actually useless, remove it. Also,
create accessors rb_subbuf_capacity() and rb_page_capacity() which
return the actual size available for storing events, while
rb_subbuf_size() returns the actual subbuf page-size.
Products Associated with CVE-2026-89771
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f9b94daa542a8d2532f0930f01cd9aec2d19621b and below 6d666f0b8b36c0765cf19fbe6de5a7ba5a73aad9 is affected.
- Version f9b94daa542a8d2532f0930f01cd9aec2d19621b and below 50f4a793c4ff24826efb0ac700989a5063cc53df is affected.
- Version f9b94daa542a8d2532f0930f01cd9aec2d19621b and below 0c7c517827a453128a8f58bfd849546a29813b27 is affected.
- Version f9b94daa542a8d2532f0930f01cd9aec2d19621b and below 8a5f63637890f03177146efddaba5ec7a1b4d61f is affected.
- Version 6.8 is affected.
- Before 6.8 is unaffected.
- Version 6.12.109, <= 6.12.* is unaffected.
- Version 6.18.50, <= 6.18.* is unaffected.
- Version 7.2.4, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.