CVE-2026-89499

The Linux kernel's tracing ring buffer fails to correctly handle a -EBUSY return from the remote swap_reader_page callback, which occurs when the writer moves the head before the remote reader catches it, typically during an event storm on a small buffer. Instead of aborting, __rb_get_reader_page_from_remote() continues with an unchanged reader ID and rearranges the local page list as though the swap had succeeded, which can splice the same page in as both the previous and new reader and corrupt the buffer's page management. A local attacker with low privileges who can reach the ring buffer's remote reader path could use this to crash the kernel or corrupt memory, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8, local vector). All systems running kernel builds that contain the remote reader code path are theoretically in scope, though triggering it requires the remote reader interface and sustained trace event activity. There is no public proof of concept and no known exploitation in the wild; the flaw was fixed upstream by treating the callback failure as a recoverable error that reports via pr_warn_ratelimited() and returns NULL.

What to do: Update to a kernel build containing this fix as soon as your distribution or vendor ships it, since the patch simply aborts the failed swap instead of corrupting the page list. In the interim, restrict access to tracefs/debugfs tracing interfaces and the ring-buffer remote reader (mmap) path to trusted users only. Monitor kernel logs for the new rate-limited 'reader page swap failed' warnings, which indicate the vulnerable path is being hit under event storms on small buffers.