CVE-2026-89748

The Linux kernel's tracing subsystem contains a logic error in simple_ring_buffer_swap_reader_page(): its retry counter is tested with '!retry', which inverts the intended outcomes on the final retry attempt. When the last link replacement succeeds, the function wrongly returns an error after the link is already updated; when it fails, the function falls through and updates the head and reader pointers as if it had succeeded, which can corrupt the trace ring buffer. The flaw is triggered by repeated failed link replacements during reader-page swaps (e.g., under contention), and a local attacker with low privileges who can reach this code path could leverage the resulting corruption for high impact to confidentiality, integrity, and availability (CVSS 7.8), consistent with kernel memory corruption and potential privilege escalation. Any Linux kernel build containing the tracing 'simple ring buffer' reader-swap implementation is affected; the advisory does not specify an exact version range. There is no known public PoC and the issue is not in CISA's KEV catalog, so no exploitation is currently known.

What to do: Apply your distribution's kernel update once the fix (treating only a negative retry counter as exhaustion and returning -EBUSY) is backported, and verify whether your running kernel includes the simple ring buffer reader-swap code. Restrict untrusted local users' access to tracing interfaces (tracefs/sysfs) on multi-user hosts. Monitor local privilege-escalation attempts and unexpected kernel warnings or trace-ring corruption until patched.