CVE-2026-89503

The Linux kernel's tracing ring buffer contains a race condition between ring_buffer_alloc_read_page(), which allocates a page for readers of the trace buffer, and ring_buffer_subbuf_order_set(), which changes the sub-buffer size (order). If the sub-buffer order changes in the middle of a reader-page allocation, the page's recorded order can end up mismatched with the memory actually allocated, so the kernel makes incorrect size assumptions about that page — a condition that can lead to memory corruption. Triggering the flaw requires local access with low privileges and the ability to exercise the ring-buffer interfaces (tracefs tracing reads combined with sub-buffer resizing), so the realistic targets are multi-user servers, container/VM hosts, and any system where untrusted users have local shell access. Successful exploitation is scored with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8), meaning memory corruption that plausibly enables local privilege escalation or a system crash. No public proof of concept is known, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Apply your distribution's kernel security updates as soon as a build containing this fix ships (the patch makes the reader-page allocation use bpage->order, eliminating the mismatch). Because exploitation requires local access, prioritize multi-user hosts, hypervisors, container hosts, and build/jump servers where untrusted users have shells. As hardening, ensure tracefs (/sys/kernel/tracing) is accessible only to root to limit reachability of the ring-buffer interfaces involved.