CVE-2026-89501

The Linux kernel's tracing ring buffer contains a race condition in which ring_buffer_subbuf_order_set(), used to resize sub-buffers (exposed via tracing interfaces such as the tracefs buffer_subbuf_order knob), can clear cpu_buffer->free_page concurrently with ring_buffer_alloc_read_page() and ring_buffer_free_read_page(). A local attacker who can trigger a sub-buffer resize while read pages are being allocated or freed can exploit this window to cause a use-after-free/double-free of the free_page, corrupting kernel memory and potentially executing code with kernel privileges, with high impact on confidentiality, integrity, and availability per the CVSS 3.1 vector. Any system running a kernel containing the vulnerable ring-buffer resize code is affected, though exploitation requires local access and sufficient privileges to reach the tracing subsystem. The fix serializes the resize operation under the cpu_buffer::lock. No public proof of concept is known and the issue is not in CISA's KEV, so exploitation in the wild is not currently evidenced.

What to do: Apply your distribution's kernel update that includes the fix, which holds cpu_buffer::lock during ring_buffer_subbuf_order_set(), and check your vendor's advisory for the specific patched package. Restrict local access and tracefs (/sys/kernel/tracing) permissions, especially on multi-tenant hosts and container environments. Monitor for unexpected writes to the buffer_subbuf_order tracefs knob, the likely trigger path.